QuantAMM

Summary

The removeOracle function in the UpdateWeightRunner.solcontract demonstrates a critical issue where state changes of approvedOracles are made before msg.sender permissions are verified. This flaw enables unauthorized modifications to the approvedOracles mapping, potentially leading to system vulnerabilities.

Vulnerability Details

pkg/pool-quantamm/contracts/UpdateWeightRunner.sol:removeOracle#L220

Incorrect Permission Check Order in removeOracle: The state change (approvedOracles[address(_oracleToRemove)] = false) is performed before the admin permission check (require(msg.sender == quantammAdmin, "ONLYADMIN")), allowing unauthorized users to modify the oracle's state.

If state modifications are performed before condition checks are completed, and the condition fails, triggering a revert, the changes will be rolled back. However, during the execution of complex logic, there might be a temporary state inconsistency that could potentially be exploited by malicious users.

Impact

• Unauthorized users could remove valid oracles by exploiting the incorrect permission check order in removeOracle. This could destabilize pools reliant on the removed oracles for accurate data.

• If state changes occur before checks and a revert is triggered, temporary inconsistencies during execution could be exploited by malicious users.

Tools Used

Manual Review

Recommendations

It is recommended to enforce permission checks before making state changes: