QuantAMM

Summary

The constructor does not check for duplicate entries in the _oracles array

Vulnerability Details

The constructor for the contract directly accepts the _oracles array and pushes its entries into the _oracles storage array without checking for duplicates. This allows for scenarios where the same oracle address appears multiple times in the array. Since the system uses the oracles array in calculations (e.g. in _getData), duplicates can lead to redundant processing, unnecessary gas consumption, and potential logic errors.

Impact

1. Unnecessary Gas Usage:

• Duplicate oracles in the oracles array cause redundant calculations during execution, such as in _getData().

• Redundant oracle configurations may lead to unnecessary gas usage and duplicate calculations.

1. Redundant or Incorrect Aggregations:

• If the same oracle is processed multiple times during data aggregation, the results may be distorted or unnecessarily duplicated.
  For example:

  • The timestamp aggregation could be incorrect (e.g. the same timestamp could be chosen multiple times.)

  • The data calculation may unnecessarily involve duplicate multiplications or divisions.

Tools Used

Manual review

Recommendations

Add logic to ensure each oracle is unique like a

• Mapping-Based Duplicate Detection (Efficient Approach)