QuantAMM

Summary

The _getData function in the MultiHopOracle contract contains critical vulnerabilities that can lead to arithmetic overflow when processing extreme oracle data values. These vulnerabilities arise from the lack of safeguards against large intermediate results during multiplication and inversion operations. Specifically, the use of excessively large scaling factors, such as 10**36 and 10**18, combined with potentially small or large oracle data values, creates scenarios where intermediate calculations exceed the range of int216.

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-quantamm/contracts/MultiHopOracle.sol#L31

Vulnerability Details

1. Overflow in the First Oracle Inversion

The first oracle's result is inverted using:

Example:

• Oracle A data: 10**-30 (price of Token A / Token B).

• Calculation:

  data = 10**36 / 10**-30 = 10**36 * 10**30 = 10**66

• Issue:
  10**66 exceeds the maximum range of int216, which is approximately 10**64. This results in an overflow error, halting the execution of the function.

2. Overflow During Multiplication in Subsequent Oracles

The subsequent oracle calculations multiply data by the next oracle's result before dividing by the precision factor 10**18:

Example:

• Initial data: 10**60 (already close to int216 limits).

• Oracle B data: 10**10 (price of Token B / Token C).

• Calculation:

  data = (10**60 * 10**18) / 10**10 = 10**78 / 10**10 = 10**68

• Issue:
  The intermediate result 10**78 exceeds the int216 range, causing an overflow before the division can occur.

Root Cause

• Excessive Scaling Factors: Using 10**36 for inversion and 10**18 for precision unnecessarily inflates intermediate values.

• No Range Checks: The function does not verify that intermediate calculations remain within the bounds of int216.

Impact

• Denial of Service: Overflow causes the contract to revert, preventing critical price data from being retrieved.

• Data Integrity Risks: Even if not exploited maliciously, genuine oracle data could cause failures, impacting dependent systems.

Tools Used

Manual Code Review
Test simulation with real life figures

Recommendation

1. Replace 10**36 with smaller scaling factors or use fixed-point arithmetic libraries:

1. Add checks to ensure intermediate values remain within safe bounds:

By implementing these recommendations, the MultiHopOracle contract can handle extreme oracle values more robustly, ensuring reliable and secure price data computation.