QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Manual weight setting allows for more weights than assets

octeezy

Summary

When executing UpdateWeightRunner::setWeightsManually there is no check for the length of the weights being equal to the number of assets. This function also verifies that the weight values are between 0 and 1e18, but only for the weights in the length of the number of assets, meaning that any other weight set beyond that doesnt have to conform to those limits.

Vulnerability Details

In this example we provide 4 weights and number of assets is set to 3 "accidentaly", because of it this fourth weight can be set to >= 1e18

function testSetWeightsManuallyMoreWeights() public {
int256[] memory weights = new int256[]();
weights[0] = 0.0000000005e18;
weights[1] = 0.0000000005e18;
weights[2] = 0.0000000005e18;
weights[3] = 3e18;
weights[4] = 0;
weights[5] = 0;
weights[6] = 0;
weights[7] = 0;
mockPool.setPoolRegistry(16);
vm.startPrank(owner);
updateWeightRunner.setApprovedActionsForPool(address(mockPool), 16);
vm.stopPrank();
​
vm.startPrank(owner);
​
updateWeightRunner.setApprovedActionsForPool(address(mockPool), 16);
// An ammount of 3 assets is accidentally passed, while also passing 4 weights
updateWeightRunner.setWeightsManually(weights, address(mockPool), 6, 3);
​
vm.stopPrank();
uint256[] memory poolWeights = new uint256[]();
poolWeights[0] = 0.0000000005e18;
poolWeights[1] = 0.0000000005e18;
poolWeights[2] = 0.0000000005e18;
poolWeights[3] = 3e18;
assertEq(IWeightedPool(address(mockPool)).getNormalizedWeights(), poolWeights);
}

So in this example a pool of 4 assets ends up with its fourth asset's weight misconfigured beyond the maximum allowed amount.

This test can be added at the end of the tests in the UpdateWeightRunner.t.sol file

Impact

Misconfiguration in the pools weights

Tools Used

Manual review

Recommendations

Add a check at the start of the UpdateWeightRunner::setWeightsManually function to verify that _weights == _numberOfAssets * 2 similar to the require statement in QuantAMMWeightedPool.sol#L623

Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas / Admin is trusted / Pool creation is trusted / User mistake / Suppositions

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!