QuantAMM

Summary

Not checking before assigning a value to the updateInterval variable when calling the QuantAMMWeightedPool::initialize function can lead to a division by zero error when calling the UpdateWeightRunner::performUpdate if updateInterval = 0.

Vulnerability Details

In QuantAMMWeightedPool::initialize function, while the other parameters of PoolSettings are checked properly, the function does not check _poolSettings.updateInterval.
This _poolSettings.updateInterval param will be pass through multiple calls:

1. QuantAMMWeightedPool::_setRule

2. UpdateWeightRunner::setRuleForPool
   And finally stored in mapping poolRuleSettings in UpdateWeightRunner contract (UpdateWeightRunner.sol#L256-L263).

And whenever the UpdateWeightRunner::performUpdate function is called, it will call _calculateMultiplerAndSetWeights function. If updateInterval has a value of 0, the following line of code in _calculateMultiplerAndSetWeights will revert due to a division by zero error (UpdateWeightRunner.sol#L472):

Impact

Can not call performUpdate to set new weights to the pool.

Tools Used

• Manual review.

Recommendations

• Add a check for zero value before assigning a value to the updateInterval variable.