QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

There is a calculation error in the `QuantAMMWeightedPool::calculateBlockNormalisedWeight` function when calculating weights for the first time.

saurabh_singh

Summary

The QuantAMMWeightedPool::calculateBlockNormalisedWeight function will calculate the weights incorrectly during the first few calculations.

Vulnerability Details

In the QuantAMMWeightedPool contract, the multipliers are explicitly set to 0 in the _setInitialWeights function. As a result, when the first calculation is carried out, the multiplier is 0, which will return weights with no change.

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-quantamm/contracts/QuantAMMWeightedPool.sol#L527

_setInitialWeights function ->

int256 normalizedSum;
int256[] memory _weightsAndBlockMultiplier = new int256[]();
for (uint i; i < _weights.length; ) {
if (_weights[i] < int256(uint256(absoluteWeightGuardRail))) {
revert MinWeight();
}
​
_weightsAndBlockMultiplier[i] = _weights[i];
normalizedSum += _weights[i];
//Initially register pool with no movement, first update will come and set block multiplier.
_weightsAndBlockMultiplier[i + _weights.length] = int256(0);
unchecked {
++i;
}
}
function calculateBlockNormalisedWeight(
int256 weight,
int256 multiplier,
uint256 timeSinceLastUpdate
) internal pure returns (uint256) {
//multiplier is always below 1 which is int128, we multiply by 1e18 for rounding as muldown / 1e18 at the end.
int256 multiplierScaled18 = multiplier * 1e18;
if (multiplier > 0) {
@>> return uint256(weight) + FixedPoint.mulDown(uint256(multiplierScaled18), timeSinceLastUpdate);
} else {
//CYFRIN H02
@>> return uint256(weight) - FixedPoint.mulUp(uint256(-multiplierScaled18), timeSinceLastUpdate);
}
}

Impact

The first or first few calculations will be wrong due to assigning the multiplier as 0, which prevents proper weight calculation and leads to incorrect results.

Tools Used

Manual review

Recommendations

  1. Do not explicitly assign 0 to the multiplier. Instead, assign a correct initial value to it.

  2. If assigning 0 is necessary initially, perform test run swaps to update the multiplier value before performing any weight calculations.

Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!