QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing Timestamp Update in calculateMultiplierAndSetWeightsFromRule() Enables MEV

huntoor

Summary

The calculateMultiplierAndSetWeightsFromRule() function doesn't update lastPoolUpdateRun timestamp, allowing attackers to sandwich rule-based weight updates with performUpdate() calls.

Vulnerability Details

function calculateMultiplierAndSetWeightsFromRule(CalculateMuliplierAndSetWeightsLocal memory params) external {
require(msg.sender == address(rules[params.poolAddress]), "ONLYRULECANSETWEIGHTS");
uint256 poolRegistryEntry = QuantAMMWeightedPool(params.poolAddress).poolRegistry();
require(poolRegistryEntry & MASK_POOL_RULE_DIRECT_SET_WEIGHT > 0, "FUNCTIONNOTAPPROVEDFORPOOL");
// Updates weights via _calculateMultiplerAndSetWeights but never updates lastPoolUpdateRun
_calculateMultiplerAndSetWeights(params);
}

Attack flow:

  1. Monitor mempool for rule-based weight calculations

  2. Buy tokens that will appreciate after weight changes

  3. After rule weight update completes, Prices spike and attacker call performUpdate() which succeeds since lastPoolUpdateRun wasn't updated

  4. Sell tokens at better prices in same transaction

Impact

  • Financial loss through MEV sandwich attacks

  • Manipulation of rule-based weight calculations

  • Bypass of updateInterval protection for rule updates

Tools Used

Manual review

Recommendations

Add timestamp update in calculateMultiplierAndSetWeightsFromRule():

function calculateMultiplierAndSetWeightsFromRule(CalculateMuliplierAndSetWeightsLocal memory params) external {
require(msg.sender == address(rules[params.poolAddress]), "ONLYRULECANSETWEIGHTS");
uint256 poolRegistryEntry = QuantAMMWeightedPool(params.poolAddress).poolRegistry();
require(poolRegistryEntry & MASK_POOL_RULE_DIRECT_SET_WEIGHT > 0, "FUNCTIONNOTAPPROVEDFORPOOL");
poolRuleSettings[params.poolAddress].timingSettings.lastPoolUpdateRun = uint40(block.timestamp);
_calculateMultiplerAndSetWeights(params);
}
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

Informational or Gas / Admin is trusted / Pool creation is trusted / User mistake / Suppositions

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!