QuantAMM

Summary

QuantAMMWeightedPool is an initializable contract, suggesting it is designed to be used via proxies. However, it is assigning non-immutable variables in its constructor, which would leave those values empty when accessed through the proxy.

Vulnerability Details

• https://github.com/Cyfrin/2024-12-quantamm/blob/main/pkg/pool-quantamm/contracts/QuantAMMWeightedPool.sol#L96

• https://github.com/Cyfrin/2024-12-quantamm/blob/main/pkg/pool-quantamm/contracts/QuantAMMWeightedPool.sol#L88

• https://github.com/Cyfrin/2024-12-quantamm/blob/main/pkg/pool-quantamm/contracts/QuantAMMWeightedPool.sol#L74

• https://github.com/Cyfrin/2024-12-quantamm/blob/main/pkg/pool-quantamm/contracts/QuantAMMWeightedPool.sol#L175-L190

Non-immutable variables should be assigned during the initialize() function to ensure the proxy can access these values.

Impact

Some critical function calls could fail when executed through a proxy.

Tools Used

Manual Review

Recommendations

Assign these variables during the initialize() function.