QuantAMM

Summary

In the function _getWeights in AntimomentumUpdateRule.sol and DifferenceMomentumUpdateRule.sol, there are comments indicating downcasting should happen at the end:

However, the actual code never performs a downcast to uint64. Instead, the final results (res) are assigned to an int256 array:

Vulnerability Details

• https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-quantamm/contracts/rules/AntimomentumUpdateRule.sol#L92

• https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-quantamm/contracts/rules/DifferenceMomentumUpdateRule.sol#L121

• https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-quantamm/contracts/rules/DifferenceMomentumUpdateRule.sol#L143

Impact

• Comment Mismatch: The documentation says one thing while the code does another, causing confusion for anyone maintaining or auditing this logic.

• Potential Overflow Concerns: If the developer’s intention was to mitigate overflow by using uint64, storing in an int256 array might undermine that objective (though in Solidity 0.8.x, overflow checks are built-in for additions/multiplications).

• Low Severity: This is not an immediate security flaw, but can lead to misunderstandings about the data type or the intended numeric range of weights.

Tools Used

Manual Audit

Recommendations

1. If downcasting is truly desired (to limit the weight’s range), implement the actual cast, for example:
   uint64 finalWeight = uint64(res); // store finalWeight somewhere