QuantAMM

Summary

Location: QuantAMMWeightedPool.sol (lines 590-614)

The setWeights function only checks that the caller is the
updateWeightRunner contract but does not validate the integrity of the weight values
themselves. This could allow manipulation of pool weights if the
updateWeightRunner contract is compromised.

Vulnerability Details

Location: QuantAMMWeightedPool.sol (lines 590-614)

The setWeights function only checks that the caller is the
updateWeightRunner contract but does not validate the integrity of the weight values
themselves. This could allow manipulation of pool weights if the
updateWeightRunner contract is compromised.

Code Snippet:

Impact

Complete draining of contract funds, manipulation of contract state.

Tools Used

Recommendations

Add additional validation checks for weight values including:
- Minimum/maximum bounds for individual weights
- Rate limiting on weight changes
- Validation of weight sum normalization
- Time delays for significant weight changes