QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Valid

The `QuantammCovarianceBasedRule::_calculateQuantAMMCovariance` returns a two dimensional array with a wrong dimension

spomaria

Summary

The QuantammCovarianceBasedRule::_calculateQuantAMMCovariance function returns a two dimensional array of size n*n by n instead of a two dimensional array of size n by n for a pool with n parameters

Vulnerability Details

The vulnerability lies here where on line 59, the two dimensional array newState is initialized with a dimension of locals.nsquared which is previously defined on line 53 as locals.n * locals.n. The affected code is also displayed below:

function _calculateQuantAMMCovariance(
int256[] memory _newData,
QuantAMMPoolParameters memory _poolParameters
) internal returns (int256[][] memory) {
QuantAMMCovariance memory locals;
locals.n = _poolParameters.numberOfAssets; // Dimension of square matrix
53: locals.nSquared = locals.n * locals.n;
int256[][] memory intermediateCovarianceState = _quantAMMUnpack128Matrix(
intermediateCovarianceStates[_poolParameters.pool],
locals.n
);
​
​
59: int256[][] memory newState = new int256[][]();
.
.
.
​
}

Impact

Any functions that depend on the return value of QuantammCovarianceBasedRule::_calculateQuantAMMCovariance could run into issues if the dimensions of the two dimensional array are needed for some decision taking. Moreover, only the first locals.n rows of the array are filled with non-zero values while the remaining locals.nsquared - locals.n rows only contain zeros.

Tools Used

Manual Review

Foundry

Recommendations

Consider modifying QuantammCovarianceBasedRule::_calculateQuantAMMCovariance as below:

function _calculateQuantAMMCovariance(
int256[] memory _newData,
QuantAMMPoolParameters memory _poolParameters
) internal returns (int256[][] memory) {
QuantAMMCovariance memory locals;
locals.n = _poolParameters.numberOfAssets; // Dimension of square matrix
locals.nSquared = locals.n * locals.n;
int256[][] memory intermediateCovarianceState = _quantAMMUnpack128Matrix(
intermediateCovarianceStates[_poolParameters.pool],
locals.n
);
​
​
- int256[][] memory newState = new int256[][]();
+ int256[][] memory newState = new int256[][]();
.
.
.
​
}
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding__calculateQuantAMMCovariance_return_a_array_with_incorrect_size

Likelihood: Informational/Very Low: Used nowhere at the moment but function in scope. Impact: Low, returns an array with an unexpected length, with a lot of element set to 0.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!