QuantAMM

Summary

The _setIntermediateCovariance function, responsible for initializing or updating the covariance matrix of a pool, aims to optimize gas usage by storing only the unique elements of a symmetric matrix. However, the implementation incorrectly calculates the required array length, leading to insufficient storage space or not gas optimization. This error can cause incomplete initialization, runtime errors, or inaccurate calculations during operations.

Vulnerability Details

The current implementation attempts to calculate the storage requirements for the covariance matrix as follows:

pkg/pool-quantamm/contracts/rules/base/QuantammCovarianceBasedRule.sol

The logic assumes halving the total matrix size for optimization. However, this approach miscalculates the storage length for unique covariance elements.

For a covariance matrix with n assets, the correct number of unique elements (including diagonal variances) is given by:

In contrast, the implementation uses:

This error results in insufficient array space for initialization.

Additionally, if only non-duplicated covariance elements are required, the correct length should be:

This optimized formula further reduces gas consumption by omitting redundant entries.

Impact

1. Incomplete Matrix Initialization

   • Insufficient storage space leads to missing covariance elements during initialization.

2. Operational Failures

   • Subsequent calculations dependent on the full covariance matrix may fail, breaking contract functionality.

3. Inaccurate Results

   • Missing elements can cause incorrect outputs in computations involving the covariance matrix.

4. Gas Inefficiency

   • Incorrectly allocated storage wastes gas and increases operational costs.

Tools Used

Manual Review

Recommendations

To address the issue, adjust the array length calculation based on the required storage type:

1. Store All Covariance Elements
   Use the formula for storing all unique elements of the matrix:

   uint256 requiredLength = (_numberOfAssets * (_numberOfAssets + 1)) / 2;

   intermediateCovarianceStates[_poolAddress] = new int256[]();

2. Store Only Non-Duplicated Covariance Elements
   If diagonal elements and symmetry are accounted for elsewhere, optimize gas usage by storing only non-duplicated covariance values:

   uint256 requiredLength = (_numberOfAssets * (_numberOfAssets - 1)) / 2;

   intermediateCovarianceStates[_poolAddress] = new int256[]();