QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

edge case leads to wrong weights calculation in MomentumUpdateRule

rzizah

Summary

the calculation of momentum could have a negative values in some cases giving these equation to calculate momentum

  • w(t) = w(t − 1) + κ · ( 1/p(t) * ∂p(t)/∂t − ℓp(t))

    • where ℓp(t) = 1/N * ∑( 1/p(t)i * ∂p(t)i/∂t)

You see that value of ℓp(t) is a sum of ( 1/p(t)i * ∂p(t)i/∂t)[i]

So ℓp(t) > every ( 1/p(t)i * ∂p(t)i/∂t)[i]

Then the second part of the equation could have a negative weight value
combining this with a small old weight result in a negative weight

POC

Add this test function in MomentumRuleTest contract

function testCorrectUpdateWithHigherPrices_negative_weights() public {
​
// Define local variables for the parameters
int256[][] memory parameters = new int256[][]();
parameters[0] = new int256[]();
parameters[0][0] = PRBMathSD59x18.fromInt(1);
parameters[1] = new int256[]();
parameters[1][0] = PRBMathSD59x18.fromInt(1);
​
int256[] memory previousAlphas = new int256[]();
previousAlphas[0] = PRBMathSD59x18.fromInt(1);
previousAlphas[1] = PRBMathSD59x18.fromInt(2);
​
int256[] memory prevMovingAverages = new int256[]();
prevMovingAverages[0] = PRBMathSD59x18.fromInt(1);
prevMovingAverages[1] = PRBMathSD59x18.fromInt(2);
​
int256[] memory movingAverages = new int256[]();
movingAverages[0] = 0.1e18;
movingAverages[1] = PRBMathSD59x18.fromInt(1) + 0.2e18;
​
int128[] memory lambdas = new int128[]();
lambdas[0] = int128(0.1e18);
​
int256[] memory prevWeights = new int256[]();
prevWeights[0] = 0.005e18;
prevWeights[1] = 0.995e18;
​
int256[] memory data = new int256[]();
data[0] = PRBMathSD59x18.fromInt(6);
data[1] = PRBMathSD59x18.fromInt(4);
​
int256[] memory expectedResults = new int256[]();
expectedResults[0] = 1.031000000000000009e18;
expectedResults[1] = -0.031000000000000009e18;
​
// Now pass the variables into the runInitialUpdate function
runInitialUpdate(
2, // numAssets
parameters,
previousAlphas,
prevMovingAverages,
movingAverages,
lambdas,
prevWeights,
data,
expectedResults
);
}

Impact

  • Wrong calculation of weights for Momentum role breaks all logic of the contract

  • Calculation of weights is a core to the protocol and can't have any small error as it have huge impact on the protocol.

Tools Used

manual review

Recommendations

apply this require with a scalar kappa

++ require(locals.res >= 0, "Invalid weight");
Updates

Lead Judging Commences

n0kto Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

invalid_weights_can_be_negative_or_extreme_values

_clampWeights will check that these weights are positive and in the boundaries before writing them in storage.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!