QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: high
Valid

Wrong calculation of gradient

rzizah

Summary

In gradient calculation if we have for example 6 gradients they get packed into 3 in intermediateGradientStates

Calculating the gradient incase of vector lambda it packs with the wrong index forwarding i instead of locals.storageArrayIndex for intermediateGradientStates which assign wrong values of the gradient.

The gradient calculation is to unpack intermediateGradientStates then enter a loop and calculate the new values and packing them again in intermediateGradientStates
the loop go as follow

  • getting the value for i and i+1

  • Calculating then packing them with index of storageArrayIndex in intermediateGradientStates

  • then i+=2 and ++locals.storageArrayIndex

a simple chart to simplify the process:

intermediateGradientStates [0] [1] [2]
stored gradient [i] 0,1 2,3 4,5

incase of a vector wrong index is used for intermediateGradientStates i instead of storageArrayIndex so values is packed as follow

intermediateGradientStates [0] [1] [2] [3] [4]
stored gradient 0,1 OldGradient (no new value stored) 2,3 0 (no value as length should be 3) 4,5

incase number of assets 7 the index is done correctly for intermediateGradientStates but overwrite one value due to wrong index used in the loop

intermediateGradientStates [0] [1] [2] [3] [4]
stored gradient 0,1 OldGradient (no value stored) 2,3 Last IntermediateValue 4,5

Affected code

File: QuantammGradientBasedRule.sol
156: intermediateGradientStates[_poolParameters.pool][i] = _quantAMMPackTwo128(
157: locals.intermediateGradientState[i],
158: locals.secondIntermediateValue
159: );
160: unchecked {
161: i += 2;
162: ++locals.storageArrayIndex;
163: }
164: }

Impact

  • broken calculation giving wrong calculations affecting all function depends on it

    • QuantAMMGradientBasedRule

    • PowerChannelUpdateRule

    • MomentumUpdateRule

    • ChannelFollowingUpdateRule

    • AntiMomentumUpdateRule

  • all roles will calculate wrong weights which is the core of the protocol and break all its logic

Tools Used

Manual review

Recommendations

Use the correct value for index

File: QuantammGradientBasedRule.sol
-- intermediateGradientStates[_poolParameters.pool][i] = _quantAMMPackTwo128(
++ intermediateGradientStates[_poolParameters.pool][locals.storageArrayIndex] = _quantAMMPackTwo128(
​
Updates

Lead Judging Commences

n0kto Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_gradient_rules_more_than_3_assets_and_1_lambda_will_DoS_the_update

Likelihood: Medium/High, assets>4, lambdas > 1. Impact: Medium/High, DoS update but pool works fine. Pool with 5 assets will use incorrect weights.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!