QuantAMM

Summary

In multiple update rule contracts (MomentumUpdateRule, PowerChannelUpdateRule, DifferenceMomentumUpdateRulem AntiMomentumUpdateRule), the validParameters function does not validate that the kappa vector length matches the number of assets. This can lead to incorrect normalization factor calculations when summing kappa values, as the function may sum more kappa values than there are assets.

Vulnerability Details

In MomentumUpdateRule and other update rules, when using vector kappa mode, the normalization factor calculation sums all kappa values:

The issue arises in case that there are more kappa values in kappaStore than there is assets. This is possible because validParameters doesn't validate kappa vector length - it only checks that kappa values are greater than 0:

Example scenario:

1. Pool has 3 assets

2. Rule's kappa vector is initialized with 4 values: [1e18, 1e18, 1e18, 1e18]

3. In weight update process, normalization will sum all 4 kappas = 4e18

4. But weight updates only use first 3 values

5. Results in incorrect normalization factor: dividing by 4 instead of 3

Impact

I consider this medium severity because:

1. Leads to incorrect weight calculations due to wrong normalization factor used

2. Affects core pool feature of correctly updating the weights

3. It is a silent issue - there will be no failures or reverts, but weight calculations will be consistently off

Tools Used

Manual review

Recommendations

Add kappa vector length validation in validParameters, or when summing the sumKappa number of iterations should go up to the number of assets in pool.