QuantAMM

Summary

The _quantAMMUnpack128Array function is designed to unpack a series of 256-bit integers into a target array of 128-bit integers. While the logic for handling typical cases appears correct, there exists a critical vulnerability when the sourceArray length and targetArrayLength parameters are mismatched. Specifically, the function does not adequately prevent out-of-bounds access during unpacking, which could lead to runtime exceptions or undefined behavior.

Vulnerability Details

The _quantAMMUnpack128Array function attempts to unpack 256-bit integers into a targetArray of 128-bit integers. Each 256-bit integer in sourceArray contributes two 128-bit values. The loop structure increments the targetIndex by 2 in each iteration. If targetArrayLength is not carefully constrained, the function will attempt to access an out-of-bounds index in the targetArray.

Scenario
Input
sourceArray = [val1, val2, val3] (length = 3)
targetArrayLength = 4
Execution Steps
On the 3rd iteration (i = 2), the function tries to assign the high 128 bits of sourceArray[2] to targetArray[4].
Since targetArray only has 4 slots (indices 0 to 3), this causes an out-of-bounds error.
Root Cause
The loop termination condition (for (uint i; i < _sourceArray.length; )) ensures that every 256-bit value in sourceArray is unpacked, regardless of whether the targetArray is already fully populated.

Impact

1. The function may attempt to write to an index outside the allocated memory for targetArray, resulting in a runtime error or undefined behavior.

2. If this function is called in a smart contract, a DoS attack could be triggered by carefully crafted inputs that cause the function to revert or fail.

Tools Used

Manual Review

Recommendations

Modify the loop to ensure that targetIndex does not exceed _targetArrayLength. The new loop structure should focus on populating targetArray completely without assuming that all sourceArray values must be unpacked