QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Out-of-bounds error in `validParameters` function leading to unexpected behavior or contract failure

safdie

Summary

The validParameters function in the assumes that _parameters[0] always exists if _parameters.length is 1 or 2. If _parameters is empty, this will cause an out-of-bounds error, potentially leading to unexpected behavior or contract failure.

Vulnerability Details

The validParameters function checks if the provided _parameters are valid. However, it does not check if _parameters is empty before accessing _parameters[0]. This can lead to an out-of-bounds error if _parameters is empty, causing the contract to revert unexpectedly.

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-quantamm/contracts/rules/AntimomentumUpdateRule.sol#L148-L164

function validParameters(int256[][] calldata _parameters) external pure override returns (bool) {
if (_parameters.length == 1 || (_parameters.length == 2 && _parameters[1].length == 1)) {
int256[] memory kappa = _parameters[0];
uint16 valid = uint16(kappa.length) > 0 ? 1 : 0;
for (uint i; i < kappa.length; ) {
if (!(kappa[i] > 0)) {
valid = 0;
break;
}
unchecked {
++i;
}
}
return valid == 1;
}
return false;
}

Using the following values:

  • _parameters: An empty array

Any user can call the validParameters function with an empty array to trigger the out-of-bounds error.

pragma solidity ^0.8.0;
​
import "forge-std/Test.sol";
import "../AntimomentumUpdateRule.sol";
​
contract AntimomentumUpdateRuleTest is Test {
AntimomentumUpdateRule rule;
​
function setUp() public {
rule = new AntimomentumUpdateRule();
}
​
function testValidParametersEmptyArray() public {
int256[][] memory parameters = new int256[][]();
bool result = rule.validParameters(parameters);
assertTrue(result == false);
}
}

Impact

The lack of input validation allows the function to access an out-of-bounds index, causing the contract to revert unexpectedly. This can lead to unexpected behavior or contract failure.

Tools Used

Manual review.

Recommendations

The lack of input validation allows the function to access an out-of-bounds index, causing the contract to revert unexpectedly. This can lead to unexpected behavior or contract failure.

function validParameters(int256[][] calldata _parameters) external pure override returns (bool) {
if (_parameters.length == 0) {
return false;
}
if (_parameters.length == 1 || (_parameters.length == 2 && _parameters[1].length == 1)) {
int256[] memory kappa = _parameters[0];
if (kappa.length == 0) {
return false;
}
uint16 valid = 1;
for (uint i; i < kappa.length; ) {
if (!(kappa[i] > 0)) {
valid = 0;
break;
}
unchecked {
++i;
}
}
return valid == 1;
}
return false;
}
Updates

Lead Judging Commences

n0kto Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

Informational or Gas / Admin is trusted / Pool creation is trusted / User mistake / Suppositions

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.