QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

The pool oracles are not configurable

biakia

Summary

The identified vulnerability revolves around the inconsistency in managing oracles within the UpdateWeightRunner contract. Specifically, the removeOracle function allows the removal of oracles from the approved list, but once oracles are set in the setRuleForPool function using the poolOracles mapping for a given pool, the oracles are permanently fixed.

Vulnerability Details

The UpdateWeightRunner contract offers a removeOracle function to remove oracles from the pool:

function removeOracle(OracleWrapper _oracleToRemove) external {
approvedOracles[address(_oracleToRemove)] = false;
require(msg.sender == quantammAdmin, "ONLYADMIN");
emit OracleRemved(address(_oracleToRemove));
}

However, in setRuleForPool function, it checks poolOracles[msg.sender].length == 0 , which means the pool oracles can not be changed once the rule for a pool is set:

function setRuleForPool(IQuantAMMWeightedPool.PoolSettings memory _poolSettings) external {
require(address(rules[msg.sender]) == address(0), "Rule already set");
require(_poolSettings.oracles.length > 0, "Empty oracles array");
require(poolOracles[msg.sender].length == 0, "pool rule already set");

This inconsistency means that even if an oracle becomes untrusted or invalidated through the removeOracle function, there is no means to replace or update the oracles previously set for a pool.

This oversight can lead to significant issues, as the system may end up relying on oracles that have been removed from the approved list, resulting in potential data inaccuracies and financial repercussions for the users relying on these oracles.

Impact

The impact is HIGH and the likelihood is LOW, so the severity is MEDIUM

Tools Used

Manual Review

Recommendations

To patch this vulnerability, a function should be introduced to update or replace the oracles associated with a pool after its creation. For example, the implementation of a new function like updateOraclesForPool could allow the authorized entities to set new or replace existing oracles, thus ensuring the correct management and functionality of the pool in response to the dynamic nature of oracle availability and reliability:

function updateOraclesForPool(address _pool, address[][] memory newOracles) external {
require(msg.sender == quantammAdmin || msg.sender == poolRuleSettings[_pool].poolManager, "Unauthorized");
// Ensure the pool exists and is set
require(address(rules[_pool]) != address(0), "Pool not registered");
​
for (uint i; i < newOracles.length; ++i) {
require(newOracles[i].length > 0, "Empty oracles array");
for (uint j; j < newOracles[i].length; ++j) {
if (!approvedOracles[newOracles[i][j]]) {
revert("Not approved oracled used");
}
}
}
address[] memory optimisedHappyPathOracles = new address[]();
for (uint i; i < newOracles.length; ++i) {
optimisedHappyPathOracles[i] = newOracles[i][0];
}
// Logic to update poolOracles mapping
poolOracles[_pool] = newOracles;
poolBackupOracles[_pool] = newOracles;
// Emit events for tracking oracle updates
emit OraclesUpdated(_pool, newOracles);
}
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

invalid_immutable_oracles/variables

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.