QuantAMM

Summary

In the QuantAMMStorage.sol _quantAMMPack128Array() function is used to packs n 128 bit integers into n/2 256 bit integers when the length of the array pass is odd then for the last element only it checks whether it is greater than min of 128bits and less than max of 128 bits. But this check should be apply for each element otherwise if value of any one integer is greater than max of 128 bits then it is silently overflowing.

Vulnerability Details

The function fails to check whether each 128-bit integer in the input array falls within the valid range (minimum of 0 and maximum of 2^128 - 1). If an element exceeds this range, it overflows and corrupts the packed data.

Example :-

//Array To Pack = 170141183460469231731687303715884105729, 170141183460469231731687303715884105729, 170141183460469231731687303715884105729, 170141183460469231731687303715884105729\

// Packed Array = -57896044618658097711785492504343953926124568782438874324533730092808912502783, -57896044618658097711785492504343953926124568782438874324533730092808912502783\

// Same Array Unpack = -170141183460469231731687303715884105727, -170141183460469231731687303715884105727, -170141183460469231731687303715884105727, -170141183460469231731687303715884105727

Impact

Wrong values will be stored in these slots

Tools Used

Manual Review

Recommendations

1. Add a validation step to ensure all elements in the input array are within the valid range for 128-bit integers before packing.