QuantAMM

Summary:

The calculateBlockNormalisedWeight function may compute weights that become negative or exceed 1e18 due to the application of multipliers over time without proper clamping. This can violate the requirement that individual weights must remain within the range [0, 1e18], and the assumption that "At any given block the pool is a fixed weighted balancer pool." Negative weights or weights exceeding one can lead to incorrect calculations and significant financial discrepancies.

Root Cause:

When calculating updated weights, the function does not enforce bounds to ensure that each weight remains within the acceptable range. While the _calculateMultiplerAndSetWeights function attempts to compute the lastTimestampThatInterpolationWorks to prevent weights from hitting guard rails, there might be discrepancies due to rounding errors or unforeseen edge cases.

Vulnerable Code:

In calculateBlockNormalisedWeight:

No checks are performed to ensure 0 <= weight <= 1e18 after the calculation.

Attack Path:

1. Multiplier Misalignment:

   • Due to timing differences or rounding errors, the calculated multiplier * timeSinceLastUpdate may exceed expected bounds.

   • Weights may inadvertently become negative or exceed 1e18 after the addition or subtraction.

2. Violation of Weight Bounds:

   • Negative weights or weights greater than 1e18 are invalid in the context of a weighted pool.

   • The pool's calculations for swaps and other operations become invalid.

3. Exploitation and Errors:

   • An attacker might exploit this by manipulating timeSinceLastUpdate or the multiplier to cause weights to go out of bounds.

   • Even without malicious intent, normal operation could result in invalid weights due to lack of clamping.

Proof of Concept (PoC):

Suppose:

• Initial weight is 0.05e18 (5%)

• multiplier is negative due to strategy adjustments, e.g., -0.01e18

• timeSinceLastUpdate is large, say 10, due to delayed updates

Calculations:

Similarly, for positive multipliers, the weight may exceed 1e18.

Recommendation:

Implement clamping in calculateBlockNormalisedWeight to ensure weights remain within the bounds [0, 1e18].

Modified Code: