QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

No Update of `locals.sumKappa` in `MomentumUpdateRule.sol`, `DifferenceMomentumUpdateRule.sol`, and `PowerChannelUpdateRule.sol` Leading to Potential Data Inconsistencies and Vulnerabilities

eta

Summary

The contracts MomentumUpdateRule.sol, DifferenceMomentumUpdateRule.sol, and PowerChannelUpdateRule.sol utilize a local variable sumKappa instead of the locals.sumKappa field defined in the QuantAMMMomentumLocals structure. Although the operation is commented as "vector logic separate to vector for efficiency," the locals.sumKappa is not updated after calculating the total sumKappa. This issue leads to data inconsistencies, prevents reusing the computed result stored in the structure and may introduce vulnerabilities if future logic assumes locals.sumKappa contains a valid updated value but instead relies on uninitialized or incorrect data.

Vulnerability Details

pkg/pool-quantamm/contracts/rules/DifferenceMomentumUpdateRule.sol:_getWeights#L132-140

pkg/pool-quantamm/contracts/rules/MomentumUpdateRule.sol:_getWeights#L111-119

pkg/pool-quantamm/contracts/rules/PowerChannelUpdateRule.sol:_getWeights#L132-140

function _getWeights(
int256[] calldata _prevWeights,
int256[] memory _data,
int256[][] calldata _parameters,
QuantAMMPoolParameters memory _poolParameters
) internal override returns (int256[] memory newWeightsConverted) {
​
...
If (...){
...
} else {
// @audit No update of `locals.sumKappa` after calculation of all sumKappa
//vector logic separate to vector for efficiency
int256 sumKappa;
for (locals.i = 0; locals.i < locals.kappaStore.length; ) {
sumKappa += locals.kappaStore[locals.i];
unchecked {
++locals.i;
}
}
...
}

No update of sumKappa field of struct: The mismatch between the struct and local variable can cause silent errors, particularly if sumKappa is later needed elsewhere via the struct.

Maintainability and Readability: Using a local variable deviates from the structural design intent. Developers may mistakenly use QuantAMMMomentumLocals.sumKappa in other parts of the code, leading to incorrect values.

Impact

  • Data Inconsistency: Updates to QuantAMMMomentumLocals.sumKappa are not reflected, which can lead to errors when the struct is accessed elsewhere.

  • Maintainability Risks: Deviation from intended design may confuse future developers and increase the chance of bugs.

Tools Used

Manual Review

Recommendations

To address the issue, it is recommended to update the locals.sumKappa field in the structure after calculating sumKappa. This ensures that the computed value is stored within the structure and can be accessed reliably by subsequent operations:

} else {
//vector logic separate to vector for efficiency
int256 sumKappa;
for (locals.i = 0; locals.i < locals.kappaStore.length; ) {
sumKappa += locals.kappaStore[locals.i];
unchecked {
++locals.i;
}
}
+ locals.sumKappa = sumKappa;
​
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas / Admin is trusted / Pool creation is trusted / User mistake / Suppositions

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!