QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Odd TokenS Length Vulnerability in _splitWeightAndMultipliers Function

ifexx445

Summary

The _splitWeightAndMultipliers function in QuantAMMWeightedPool.sol line 722 is designed to split an array of weights and multipliers into two separate arrays. However, it assumes that the input length is always even, dividing it into equal halves of weights and multipliers. If the input array has an odd length, the calculation of tokenLength = weights.length / 2 truncates the fractional part, resulting in potential indexing issues and incorrect handling of data.

Vulnerability Details

function _splitWeightAndMultipliers(
int256[] memory weights
) internal pure returns (int256[][] memory splitWeights) {
uint256 tokenLength = weights.length / 2;
splitWeights = new int256[][]();
splitWeights[0] = new int256[]();
for (uint i; i < 4; ) {
splitWeights[0][i] = weights[i];
splitWeights[0][i + 4] = weights[i + tokenLength];
​
unchecked {
i++;
}
}
​
splitWeights[1] = new int256[]();
​
uint256 moreThan4Tokens = tokenLength - 4;
for (uint i = 0; i < moreThan4Tokens; ) {
uint256 i4 = i + 4;
splitWeights[1][i] = weights[i4];
splitWeights[1][i + moreThan4Tokens] = weights[i4 + tokenLength];
​
unchecked {
i++;
}
}
}

  • The function assumes weights.length is always even and divides it by 2 (tokenLength = weights.length / 2) without validating this assumption.

  • If weights.length is odd, tokenLength becomes an incorrect value, as Solidity truncates division results to the nearest integer (e.g., 5 / 2 = 2).

  • The first loop correctly processes the first half of the weights but may fail to account for all tokens due to incorrect tokenLength.

Impact

The function produces incomplete or malformed splitWeights arrays

Tools Used

Manual Audits

Recommendations

Require tokens length be divisible by 2 before spliiting

Updates

Lead Judging Commences

n0kto Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!