QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

_sourceArray.length will always < 8 when targetArrayLength ==0

zhanmingjing

Summary

in function quantAMMPack32Array(), _sourceArray.length will always < 8 when targetArrayLength ==0. Therefore, there is no need to check _sourceArray.length when targetArrayLength ==0, in order to save gas.

Vulnerability Details

https://github.com/Cyfrin/2024-12-quantamm/blob/main/pkg/pool-quantamm/contracts/QuantAMMStorage.sol#L258-L262

function quantAMMPack32Array(int256[] memory _sourceArray) internal pure returns (int256[] memory targetArray) {
uint targetArrayLength;
uint storageIndex;
uint nonStickySourceLength;
​
//logic if more than 1 slot is required to store the array
if (_sourceArray.length >= 8) {
......
}
​
if (targetArrayLength == 0) {
unchecked {
if (_sourceArray.length <= 8) {
targetArrayLength = 1;
} else {
targetArrayLength = (nonStickySourceLength / 8) + 1;
}
​
targetArray = new int256[](targetArrayLength);
}
}
//pack up to 7 sticky ends
uint stickyEndElems = _sourceArray.length - nonStickySourceLength;
if (stickyEndElems > 0) {
uint offset = 224;
int256 packed;
for (uint i = nonStickySourceLength; i < _sourceArray.length; ) {
unchecked {
int256 elem = _sourceArray[i] / 1e9;
require(elem <= MAX32 && elem >= MIN32, "Overflow");
packed |= int256(uint256(elem << 224) >> 224) << offset;
offset -= 32;
++i;
}
}
targetArray[storageIndex] = packed;
}
}
}
​

If (_sourceArray.length >= 8), targetArrayLength will be set to a value >= 1. So, when it goes to line256, if targetArrayLength==0, it means, _sourceArray.length < 8, no need to check between _sourceArray.length and 8, setting targetArrayLength = 1 is enough.

Impact

Useless operations will cause more gas.

Tools Used

manually reviewed

Recommendations

if (targetArrayLength == 0) {
unchecked {
targetArrayLength = 1;
targetArray = new int256[](targetArrayLength);
}
}
Updates

Lead Judging Commences

n0kto Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas / Admin is trusted / Pool creation is trusted / User mistake / Suppositions

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.