QuantAMM

Summary

The poolMnager can change/reset the lastPoolUpdateRun anytime, which will affect how weights are updated in the pool adversely, as there are no measures in place to restrict the resetting of the lastPoolUpdateRun.

Vulnerability Details

The function InitialisePoolLastRunTime() is used to set a new PoolLastRunTime, and only the adminandpoolManagercan call these functions. The issue here is that although the admin is trusted, the poolManager is unfortunately not, because anyone can create a pool, so even malicious actors can also do the same. Now if a malicious actor happens to get ahold of this role, they can suddenly update the last runtime, which is always queried to determine the interval between updates, which tells when the next update should take place. Since there are no checks in place to validate the reset of thelastPoolUpdateRun` poolManager can directlyinfluence update of the pool weights or stop their update totally, which is against the protocol design for QuantAMMPools.
see code here

PERMLINK: https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-quantamm/contracts/UpdateWeightRunner.sol#L313

Impact

High. Users can lose their rewards due to sudden weight change, which is unaccounted for. Malicious poolMnager can cause users to lose funds during important pool operations or delay weight updates for selfish reasons.

Tools Used

Manual Review.

Recommendations

Although allowing poolManager to set the lastPoolUpdateRun makes the code more flexible, it also introduces risks in the protocol. Here are a few suggested recommendations for mitigating this issue.

• Validate _time. This ensures that the time set or being set is within acceptable range, such as setting time that is not too in the past or too far in the future.

• Limit rate of setting new lastPoolUpdateRun. This ensures that frequencies of setting/resetting the lastPoolUpdateRun become small. This can be done by enforcing a minimum time interval between updates.