QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: high
Valid

Wrong calculation of Variance

rzizah

Summary

In variance calculation it packs each 2 variance in 1 and if number of assets is odd then last will be appended directly at the end.

Incase of odd number and a vector lambda the check for notDivisbleByTwo is missing leading to wrong values being calculated

logic goes as follow

  • if length is even ex: 8

intermediateVarianceStates [0] [1] [2] [3]
indexes packed 0,1 2,3 4,5 6,7
- loop go untill 7
- with i being 0,2,4,6
- secondIndex 1,3,5,7

  • if length is 7

intermediateVarianceStates [0] [1] [2] [3]
indexes packed 0,1 2,3 4,5 6
- loop go untill 5
- i is 0,2,4
- secondIndex 1,3,5
- this store 6 values and the 7th stored separetly out of the loop

With vector lambda subtracting 1 from nMinusOne is missing leading to loop go as follow

intermediateVarianceStates [0] [1] [2] [3] [4]
indexes packed 0,1 2,3 4,5 6,7 8

with values of index 7,8 is zero leading to wrong calculation and mismatching of future variance calculation
- wrong values will be calculated
- admin can't assign the correct values as length won't match his inputted data

File: QuantammVarianceBasedRule.sol
196: /// @param _numberOfAssets the number of assets in the pool
197: function _setIntermediateVariance(
198: address _poolAddress,
199: int256[] memory _initialValues,
200: uint _numberOfAssets
201: ) internal {
202: uint storeLength = intermediateVarianceStates[_poolAddress].length;

  1. wrong values stored as in this example storage length is retrieved from tokens length and %2 !=0 so value will be retrieved in this example index[3] that holds a packed value without unpacking and the wrong value will be used

Impact

  • broken calculation giving wrong calculation affecting all function depends on it

    • MinimumVarianceUpdateRule

Tools Used

manual review

Recommendations

apply the correct check incase of odd number incsae of vector lambda

++ if (locals.notDivisibleByTwo) {
++ unchecked {
++ --locals.nMinusOne;
++ }
++ }
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_calculateQuantAMMVariance_revert_when_vector_lambda_and_odd_asset_number

Likelihood: Medium/High, odd asset number + lambda is a vector. Impact: Medium/High, DoS the update.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!