QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Inconsistent Weight Validation Between Vector and Scalar Calculations

waydou

Summary

The weight calculation implementation shows an inconsistency in validation between vector and scalar modes. The vector calculation enforces positive weights through a require statement, while the scalar calculation lacks this validation despite this difference not being specified in the whitepaper.
This issue arises both in DifferenceMomentumUpdateRule.sol
and ChannelFollowingUpdateRule.sol

Vulnerability Details

In the vector calculation mode (kappaStore.length > 1), there's an explicit check that ensures weights remain positive:

//vector logic
for (locals.i = 0; locals.i < _prevWeights.length; ) {
locals.res = int256(_prevWeights[locals.i]) +
locals.kappaStore[locals.i].mul(locals.newWeights[locals.i] - locals.normalizationFactor);
require(locals.res >= 0, "Invalid weight"); // Enforces positive weights
newWeightsConverted[locals.i] = locals.res;
unchecked {
++locals.i;
}
}

However, in the scalar calculation mode (kappaStore.length == 1), this validation is missing:

//scalar logic
for (locals.i = 0; locals.i < locals.prevWeightLength; ) {
int256 res = int256(_prevWeights[locals.i]) +
locals.kappaStore[0].mul(locals.newWeights[locals.i] - locals.normalizationFactor);
newWeightsConverted[locals.i] = res; // No validation of weight positivity
unchecked {
++locals.i;
}
}

This logic is not justified by the whitepaper this behavior not being documented in the whitepaper opena possibility of revert or wrong calculation for negative weights that can lead to bad returns

Impact

While not immediately exploitable, this inconsistency could lead to:

  • Unexpected negative weights in scalar mode

  • Different behavior between scalar and vector modes

  • Protocol behavior that deviates from whitepaper specifications

  • Potential economic implications if negative weights affect pool operations

Tools Used

Manual Review

Recommendations

Add the same validation to scalar mode to ensure consistency and robust tests for such case

Updates

Lead Judging Commences

n0kto Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

invalid_weights_can_be_negative_or_extreme_values

_clampWeights will check that these weights are positive and in the boundaries before writing them in storage.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!