QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect implementation of _clampWeights will cause weights to be amplified.

sunnykitten143

Summary

Incorrect implementation of _clampWeights will cause weights to be amplified.

Vulnerability Details

In function _clampWeights, the sumOtherWeights is calculated wrongly, which will cause the _weights to be amplified. A specific example is when only one weight is less than absoluteMin, and only one weight is greater than absoluteMax, proportionalRemainder will be equal to (1-absoluteMin)/absoluteMax which may be larger than 1, e.g. weights = [0.2e18, 0.2e18, 0.1e18, 0.5e18] and absoluteMin = 0.2e18, absoluteMax = 0.4e18. Then proportionalRemainder = 0.8/0.4 = 2, sofinal weights will be [0.4e18, 0.4e18, 0.2e18, 0.8e18], which is a total mistake.

Impact

Weights will be calculated wrongly.

Tools Used

None

Recommendations

The correct way to calculate sumOtherWeights is to add all weights greater than or equal to absoluteMin.

function _clampWeights(
// ...
for (uint i; i < weightLength; ++i) {
if (_weights[i] < absoluteMin) {
_weights[i] = absoluteMin;
sumRemainerWeight -= absoluteMin;
} else {
if (_weights[i] > absoluteMax) {
_weights[i] = absoluteMax;
}
sumOtherWeights += _weights[i];
}
}
// ...
}
​
​
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_clampWeights_normalizeWeightUpdates_incorrect_calculation_of_sumOtherWeights_proportionalRemainder

Likelihood: Medium/High, when a weight is above absoluteMax. Impact: Low/Medium, weights deviate much faster, and sum of weights also.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!