QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

wrong implement of _quantAMMUnpack128Matrix

bareli

Summary

Here in the _quantAMMUnpack128Matrix, let's say we have _sourceArray has 6 elements and _numberOfAssets is 3 then

_sourceArray.length * 2 >= _numberOfAssets * _numberOfAssets,

1 2|3 4|5 6|7 8|9 10|11 12

1 2 3

4 5 6

7 8 9

11 12

this is a wrong implementation of the _quantAMMUnpack128Matrix.

Vulnerability Details

function _quantAMMUnpack128Matrix(
int256[] memory _sourceArray,
uint _numberOfAssets
) internal pure returns (int256[][] memory targetArray) {
// | 1 2 | 3 4 | 5 6 | 7 8 | 9 \_ |
// becomes 2d array of 3 elements each with 3 elements
​
// | |1|, |2|, |3|, |
// | |4|, |5|, |6|, |
// | |7|, |8|, |9| |
require(_sourceArray.length * 2 >= _numberOfAssets * _numberOfAssets, "Source cannot provide target");
targetArray = new int256[][]();
for (uint i; i < _numberOfAssets; ) {
targetArray[i] = new int256[]();
unchecked {
++i;
}
}
​
uint targetIndex;
uint targetRow;
for (uint i; i < _sourceArray.length; ) {
if (targetIndex < _numberOfAssets) {
targetArray[targetRow][targetIndex] = int256(int128(_sourceArray[i] >> 128));
unchecked {
++targetIndex;
}
​
if (targetIndex < _numberOfAssets) {
targetArray[targetRow][targetIndex] = int256(int128(_sourceArray[i]));
unchecked {
++targetIndex;
}
} else {
unchecked {
++targetRow;
targetIndex = 0;
}
if (targetRow < _numberOfAssets) {
targetArray[targetRow] = new int256[]();
if (targetIndex < _numberOfAssets) {
targetArray[targetRow][targetIndex] = int256(int128(_sourceArray[i]));
unchecked {
++targetIndex;
}
}
}
}
} else {
unchecked {
++targetRow;
targetIndex = 0;
}
if (targetRow < _numberOfAssets) {
targetArray[targetRow] = new int256[]();
targetArray[targetRow][targetIndex] = int256(int128(_sourceArray[i] >> 128));
unchecked {
++targetIndex;
}
​
if (targetIndex < _numberOfAssets) {
targetArray[targetRow][targetIndex] = int256(int128(_sourceArray[i]));
unchecked {
++targetIndex;
}
} else {
unchecked {
++targetRow;
targetIndex = 0;
}
if (targetRow < _numberOfAssets) {
targetArray[targetRow] = new int256[]();
}
}
}
}
​
unchecked {
++i;
}
}
​
if ((_numberOfAssets * _numberOfAssets) % 2 != 0) {
targetArray[_numberOfAssets - 1][_numberOfAssets - 1] = int256(
int128(_sourceArray[_sourceArray.length - 1])
);
}
}

}

Impact

_quantAMMUnpack128Matrix will be wrong implemented.

Tools Used

Recommendations

Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

invalid_pack/unpack_matrix_array_odd_number_or_big_length

Called only in QuantammCovarianceBasedRule.sol with trusted parameters (set during creation or per a trusted function): `intermediateCovarianceStates[_poolAddress]`/`intermediateCovarianceStates[_poolParameters.pool]`. No real impact.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!