QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect packing of `intermediateGradientState` array in QuantAMMGradientBasedRule for vector lambda(λ)

honour

Summary

Packing of storage array intermediateGradientState in QuantAMMGradientBasedRule::_calculateQuantAMMGradient is incorrect for vector lambda(λ) parameter calculation. The Packing uses the loop variable i to index the array instead of the dedicated storageArrayIndex variable, this eventually DoSes the function due to out of bounds array access as the length of the intermediateGradientState array is half the number of tokens

Vulnerability Details

In QuantAMMGradientBasedRule::_calculateQuantAMMGradient the packing of the array intermediateGradientState uses the loop variable i in packing the array as shown here

function _calculateQuantAMMGradient(
int256[] memory _newData,
QuantAMMPoolParameters memory _poolParameters
) internal returns (int256[] memory) {
//...SNIP...
​
locals.secondIntermediateValue =
convertedLambda.mul(locals.intermediateGradientState[locals.secondIndex]) +
(_newData[locals.secondIndex] - _poolParameters.movingAverage[locals.secondIndex]).div(
oneMinusLambda
);
​
locals.finalValues[locals.secondIndex] = locals.mulFactor.mul(locals.secondIntermediateValue);
​
@> intermediateGradientStates[_poolParameters.pool][i] = _quantAMMPackTwo128(
locals.intermediateGradientState[i],
locals.secondIntermediateValue
);
unchecked {
i += 2;
++locals.storageArrayIndex;
}
}
//...SNIP
}
​
return locals.finalValues;
}

As we can see from line 156 , the issue is that the length of the intermediateGradientState array is < than the number of tokens, this means that asides from incorrect packing as is incremented by 2 on every iteration,i will be incremented until it exceeds the length of the array, DoSing the function as the array access is out of bounds

Impact

High - incorrect Packing of storage array would lead to permanent DoS

Tools Used

Manual Review

Recommendations

replace i with locals.storageArrayIndex

​
- intermediateGradientStates[_poolParameters.pool][i] = _quantAMMPackTwo128(
+ intermediateGradientStates[_poolParameters.pool][locals.storageArrayIndex] = _quantAMMPackTwo128(
locals.intermediateGradientState[i],
locals.secondIntermediateValue
);
​
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_gradient_rules_more_than_3_assets_and_1_lambda_will_DoS_the_update

Likelihood: Medium/High, assets>4, lambdas > 1. Impact: Medium/High, DoS update but pool works fine. Pool with 5 assets will use incorrect weights.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.