QuantAMM

Summary

The _setInitialMovingAverages function in the QuantammMathMovingAverage contract uses an OR condition to determine when moving averages can be set, leading to potential ambiguity:

1. For New Pools: The condition allows initialization regardless of _initialMovingAverages.length, potentially causing invalid data to be set.

2. For New and Existing Pools: If updates are allowed for both new and existing pools, only the length check is required.

Vulnerability Details

pkg/pool-quantamm/contracts/rules/base/QuantammMathMovingAverage.sol:_setInitialMovingAverages#L69

This OR relationship creates ambiguity in the intended behavior: For new pools, the condition allows initialization irrespective of _initialMovingAverages.length, potentially leading to incorrect initial values.

• For Both New and Existing Pools: If the function is meant to update moving averages for both new and existing pools, it is sufficient to check:

  require(_initialMovingAverages.length == _numberOfAssets, "Invalid length");

• For New Pools Only: If the function is restricted to new pools, the condition should use an AND relationship to ensure stricter checks:

  if (movingAverageLength == 0 && _initialMovingAverages.length == _numberOfAssets) {

  movingAverages[_poolAddress] = _quantAMMPack128Array(_initialMovingAverages);

  } else {

  revert("Invalid initialization");

  }

Impact

• Data Integrity Risk: Ambiguous logic may cause incorrect behavior, depending on the intended usage.

• Operational Vulnerabilities: Incorrect assumptions in the function’s design may lead to inconsistent pool data or overwriting of existing data.

• Potential Exploitation: Malicious actors or programming errors could exploit this to tamper with moving averages.

Tools Used

Manual Review

Recommendations

Clarify Intended Functionality: Determine whether _setInitialMovingAverages should support:

• Both New and Existing Pools: Simplify the check to ensure only the length matches:

  require(_initialMovingAverages.length == _numberOfAssets, "Invalid length");

• Only New Pools: Update logic to strictly enforce the AND condition.

  if (movingAverageLength == 0 && _initialMovingAverages.length == _numberOfAssets) {...}