QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Potential Underflow in `calculateBlockNormalisedWeight` Function Leading to Reverts

galturok

Summary:

The calculateBlockNormalisedWeight function can cause an underflow when the weight variable is smaller than the product of a negative multiplier and timeSinceLastUpdate. This underflow occurs during the subtraction operation and leads to a revert, potentially disrupting the contract's functionality.

Root Cause:

In the calculateBlockNormalisedWeight function, when the multiplier is negative, the function computes:

return uint256(weight) - FixedPoint.mulUp(uint256(-multiplierScaled18), timeSinceLastUpdate);

If the result of FixedPoint.mulUp(uint256(-multiplierScaled18), timeSinceLastUpdate) exceeds weight, the subtraction underflows, causing the transaction to revert due to an arithmetic error. Since Solidity 0.8.x has built-in overflow and underflow checking, this scenario will halt execution.

Vulnerable Code:

function calculateBlockNormalisedWeight(
int256 weight,
int256 multiplier,
uint256 timeSinceLastUpdate
) internal pure returns (uint256) {
// multiplier is always below 1 which is int128, we multiply by 1e18 for rounding as mulDown / 1e18 at the end.
int256 multiplierScaled18 = multiplier * 1e18;
if (multiplier > 0) {
return uint256(weight) + FixedPoint.mulDown(uint256(multiplierScaled18), timeSinceLastUpdate);
} else {
// Possible underflow here
return uint256(weight) - FixedPoint.mulUp(uint256(-multiplierScaled18), timeSinceLastUpdate);
}
}

Attack Path:

  1. Conditions Alignment:

    • weight is a small positive integer.

    • multiplier is a negative value with a significant magnitude.

    • timeSinceLastUpdate is large (e.g., due to a delayed update).

  2. Execution: When calculateBlockNormalisedWeight is called under these conditions, the multiplication results in a value larger than weight.

  3. Underflow Occurs: The subtraction underflows, causing the function to revert.

  4. Impact: Legitimate operations fail due to the arithmetic revert, potentially halting essential contract functions and affecting users.

Proof of Concept (PoC):

Assuming:

  • weight = 1

  • multiplier = -1e18 (i.e., -1 in 18 decimal fixed-point representation)

  • timeSinceLastUpdate = 2

Calculations:

  • multiplierScaled18 = -1e18 * 1e18 = -1e36

  • -multiplierScaled18 = 1e36

Compute:

uint256 subtractionAmount = FixedPoint.mulUp(1e36, 2); // Large number
// subtractionAmount = 1e36 * 2 / 1e18 = 2e18
​
uint256 result = uint256(weight) - subtractionAmount;
// result = 1 - 2e18 -> Underflow occurs, transaction reverts

Recommendation:

Add a check to ensure that the subtraction does not underflow by verifying that weight is greater than or equal to the subtraction amount before performing the operation. Alternatively, use SafeMath library functions or Solidity's checked arithmetic to handle potential underflows gracefully.

Modified Code:

function calculateBlockNormalisedWeight(
int256 weight,
int256 multiplier,
uint256 timeSinceLastUpdate
) internal pure returns (uint256) {
int256 multiplierScaled18 = multiplier * 1e18;
if (multiplier > 0) {
return uint256(weight) + FixedPoint.mulDown(uint256(multiplierScaled18), timeSinceLastUpdate);
} else {
uint256 subtractionAmount = FixedPoint.mulUp(uint256(-multiplierScaled18), timeSinceLastUpdate);
require(uint256(weight) >= subtractionAmount, "Underflow detected in weight calculation");
return uint256(weight) - subtractionAmount;
}
}
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas / Admin is trusted / Pool creation is trusted / User mistake / Suppositions

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!