QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

The `QuantAMMMathMovingAverage::_setInitialMovingAverages` function has an incorrect check, which allows reinitialization of the initial weights for a pool.

saurabh_singh

Summary

The QuantAMMMathMovingAverage::_setInitialMovingAverages function contains an incorrect check, which allows the reinitialization of initial weights.

Vulnerability Details

The given if condition will initialize the weights when:

  1. movingAverageLength == 0 or

  2. _initialMovingAverages.length == _numberOfAssets

This is incorrect. If a pool initializes the weights during creation and later this function is called with _initialMovingAverages.length == _numberOfAssets, the weights will be reinitialized for that pool, overriding the initial weights.

Becasue of incorrect or ( || )condition the bug happens.

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-quantamm/contracts/rules/base/QuantammMathMovingAverage.sol#L62

/// @param _poolAddress address of pool being initialised
/// @param _initialMovingAverages array of initial moving averages
/// @param _numberOfAssets number of assets in the pool
function _setInitialMovingAverages(
address _poolAddress,
int256[] memory _initialMovingAverages,
uint _numberOfAssets
) internal {
uint movingAverageLength = movingAverages[_poolAddress].length;
​
@>> if (movingAverageLength == 0 || _initialMovingAverages.length == _numberOfAssets) {
//should be during create pool
movingAverages[_poolAddress] = _quantAMMPack128Array(_initialMovingAverages);
} else {
revert("Invalid set moving avg");
}
}

Impact

The initial weights will be overwritten by new weights, causing incorrect calculations.

Tools Used

Manual Review

Recommendations

Replace the or ( || )condition with AND ( && )condition check.

/// @param _poolAddress address of pool being initialised
/// @param _initialMovingAverages array of initial moving averages
/// @param _numberOfAssets number of assets in the pool
function _setInitialMovingAverages(
address _poolAddress,
int256[] memory _initialMovingAverages,
uint _numberOfAssets
) internal {
uint movingAverageLength = movingAverages[_poolAddress].length;
​
- if (movingAverageLength == 0 || _initialMovingAverages.length == _numberOfAssets) {
+ if (movingAverageLength == 0 && _initialMovingAverages.length == _numberOfAssets) {
//should be during create pool
movingAverages[_poolAddress] = _quantAMMPack128Array(_initialMovingAverages);
} else {
revert("Invalid set moving avg");
}
}
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!