QuantAMM

Summary

The _getData function relies on a single global oracle staleness threshold value retrieved from the getOracleStalenessThreshold() function to validate the freshness of oracle data across multiple oracles. However, the declared mapping ruleOracleStalenessThreshold for per-oracle staleness thresholds is not utilized in the staleness validation logic. This creates inflexibility and undermines the protocol's ability to handle varying staleness thresholds for different oracles.

Vulnerability Details

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-quantamm/contracts/UpdateWeightRunner.sol#L347

In the _getData function oracleStalenessThreshold is retrieved using the function getOracleStalenessThreshold() from the QuantAMMWeightedPool contract. This value is then applied uniformly to all oracles in the pool during the staleness validation. The key part of the logic is:

This check ensures that only oracle data with a timestamp within the staleness threshold (i.e., fresh data) is considered valid. However, this mechanism applies the same threshold to all oracles without considering if some oracles require a different staleness threshold.

The mapping mapping(address => uint) public ruleOracleStalenessThreshold in the same contract
was presumably intended to support per-oracle staleness thresholds allowing each oracle to have its own distinct threshold. However, it is never referenced or utilized in the staleness validation logic of _getData.

Without the ability to apply oracle-specific thresholds, data that may be valid and fresh for one oracle could be rejected due to a globally applied threshold. Conversely, data from slower oracles could be considered fresh even though it is outdated leading to inconsistent outputs.

Impact

Stale data can be incorrectly considered valid and/or fresh data being prematurely discarded.

Tools Used

Manual Review

Recommendations

Modify the _getData function to utilize the ruleOracleStalenessThreshold mapping for per-oracle staleness checks.