Summary

The onSwap function in QuantAMMWeightedPoolhas a check that limits the size of trades for swaps. This check can be used by attackers to deny users from swapping tokens.

Vulnerability Details

In the onSwapfunction look at this section of the code:

If the amount being swapped is greater than a certain percentage of the total amount of those tokens in the pool, then the trade will revert (a similar check exists for EXACT_OUTas well).

This percentage is defined as the maxTradeSizeRatio

maxTradeSizeRatio has the following limits:

So, maxTradeSizeRatiocan be between 0 and 30% of the total tokens in the pool (the token being swapped). The value of maxTradeSizeRatiois set by the pool creator upon initialization.

Let's say that the value was set to 0.1e18 (10%)

1. An attacker observes that onSwap is being called by the vault and about 9.5% of the total tokens of token A are being swapped for token B.

2. So, the attacker swaps token B for token A, frontrunning the previous transaction and hence decreasing the amount of token A from the pool.
   ( -> Starting with 100 tokens of token A in the pool.
   -> Vault swaps 9.5%, so it's trying to swap 9.5 tokens.

   -> For this transaction to revert, 9.5 tokens need to become > 10% of the new total supply after the attacker's transaction.

   -> Let's say the attacker removes x% of tokens. After the attacker's transaction,
   new supply = (100 - x) tokens

   For the transaction to revert: 9.5 > (100-x) / 10
   => 95 > 100-x
   => x > 5

   Therefore, the attacker needs to remove more than 5% of token A from the pool to make my 9.5% swap exceed the 10% limit.)

3. This would ensure that the initial transaction becomes greater than 10% of the total number of token A in the pool. And hence, the transaction would revert.

4. The attacker then swaps token A for token B, restoring the previous conditions.

The attacker can keep doing this to DOS big swaps.

Impact

Swaps close to the maxTradeSizeRatiowill get reverted as they are prone to DOS attacks

Tools Used

Manual review

Recommendations

Narrow the range for maxTradeSizeRatio. Do not let it be between 0 and 30% in setRules function. Smaller maxTradeSizeRatio are extremely prone to this attack. Use a range between 25%-30%, or higher. This would make it highly unlikely for an attacker to DOS swap transactions.