QuantAMM

Summary

Each pool currently uses a single oracleStalenessThreshold for all its assets and the oracles associated with them.

The staleness threshold should reflect the heartbeat of the oracle’s price feed. This information can be found in Chainlink’s list of Ethereum mainnet price feeds by selecting the “Show More Details” option, which reveals the “Heartbeat” column for each feed.

This approach doesn’t work well for assets with varying volatility, such as BTC (volatile) and USD (stable). As a result, stable assets face frequent reverts when the threshold is set too low, while volatile assets may use outdated prices when the threshold is set too high.

Note:

ruleOracleStalenessThreshold has been defined in the UpdateWeightRunner.sol code to map each oracle address to a staleness threshold, but it is not being used anywhere in the code.

Vulnerability Details

1. The user calls the performUpdate() function in UpdateWeightRunner.sol, which triggers the following call chain to get oracle data:

• performUpdate() → _performUpdateAndGetData() → _getUpdatedWeightsAndOracleData() → _getData()

2. In the _getData() function, it calls pool.getOracleStalenessThreshold() and applies this single oracleStalenessThreshold to check the staleness for all oracles in the loop:

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-quantamm/contracts/UpdateWeightRunner.sol#L354-L361

However, this threshold is used to compare the timestamps of all assets and all oracles, regardless of their asset type or individual staleness threshold.

Impact

If the pool’s staleness threshold is set too high, many stale prices will be included in weight calculations, potentially causing losses for users. Conversely, if the threshold is set too low, assets with longer update intervals (higher heartbeat) will often have their prices marked as stale, leading to frequent reverts.

Tools Used

vscode

Recommendations

• Use the ruleOracleStalenessThreshold mapping in the code to allow each oracle to have its own staleness threshold, better matching the volatility and update frequency of the assets.

• Update the _getData() function to account for individual oracle thresholds rather than applying a single global threshold to all oracles in the pool. This would improve accuracy and reduce the risk of stale price data.