QuantAMM

Summary

The _clampWeights function in QuantAMMMathGuard contract is supposed to enforce individual weight bounds. However its implementation fails critically by violating two fundamental invariants: the total weight sum and maximum weight constraints. The function's rebalancing logic can paradoxically increase weights above their maximum allowed values while attempting to normalize them.

Vulnerability Details

Function _clampWeights in QuantAMMMathGuard is used every time new weights are calculated. Function docs state that:

/// @notice Applies guard rails (min value, max value) to weights and returns the normalized weights

Normalized weights means that their sum should be 1. Even if weights sum was not 1, at least ratio between weights should be correct.

Function implementation has 2 main parts - clamping part and rebalancing part. Problem is in broken rebalancing logic. It can totally distort weight values in multiple ways:

• weight sum can end up being >1

• weight can go way outside of guardrails

• ratio between weights can get totally distorted

Consider this example of 5-asset pool weights, which showcases critical outcome (note, e18 of every weight is omitted for print clarity):

Issues demonstrated by the example:

1. Total sum is 1.3, which is obviosuly greater than targeted sum of 1

2. 1st weight is 0.9. That's way above absoluteMax of 0.6. And way worse than initial value of 0.61 which was supposed to be clamped to 0.6

3. Weight ratios are totally distorted. While 1st weight is supposed to be ~6x the other weights, it actually ended up being 9x greater.

Impact

• Critical violation of maximum weight constraint: weights can exceed their maximum bounds after rebalancing

• Broken sum invariant: total weight can exceed 100%

• Manipulation potential: attackers could exploit these violations for price manipulation

• Protocol safety: breaks invariants that other contracts might rely on

Even though other parts of code might attempt re-normalization, _clampWeights can distort the weights and their ratios and introduce irreversible calculation mistakes.

Tools Used

Manual code review

Recommendations

Rewrite the rebalancing logic of _clampWeights that properly maintains invariants.