Summary

The _quantAMMPack128Matrix function in VectorRuleQuantAMMStorage contract fails to enforce the correct array length for storing packed matrix elements. For a 3x3 matrix example, the target array must be exactly 5 elements as specified in the comments, but the code allows for different lengths.

Vulnerability Details

Here's the current implementation:

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-quantamm/contracts/QuantAMMStorage.sol#L386C7-L388C1

The comment clearly states:

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-quantamm/contracts/QuantAMMStorage.sol#L380C6-L382C43

For a 3x3 matrix with 9 elements:

• Each storage slot holds 2 elements (except the last one)

• 8 elements require 4 full slots

• The 9th element requires 1 half-filled slot

• Total required slots = 5

However, the validation only checks if the target array is large enough (>=) rather than enforcing an exact size match for optimal storage usage.

Similar issue is in _quantAMMUnpack128Matrix function:

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-quantamm/contracts/QuantAMMStorage.sol#L429C8-L436C111

Impact

The current implementation allows arrays larger than necessary and it is inconsistent with the documented design.

Tools Used

Manual review

Recommendations

Implement the exact length validation.