Summary

The setWeightsManually function allows you to manually alter weights for assets in a pool. When _numberOfAssets is less than the length of the _weights array, the function only validates a portion of the weights, leaving unvalidated values in the array. This presents possible dangers since unvalidated items can avoid intended limits.

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-quantamm/contracts/UpdateWeightRunner.sol#L579

Vulnerability Details

Issue: Partial Validation of _weights Array

The validation loop in the setWeightsManually function checks weights only for indices less than _numberOfAssets:

If _numberOfAssets is less than _weights.length, weights at indices greater than or equal to _numberOfAssets are not validated. These unchecked weights may contain invalid or malicious values.

Impact

The vulnerability can lead to Bypassing Validation, as unvalidated elements in the _weights array could have negative values or exceed the 1e18 limit, which might disrupt pool calculations or lead to undefined behavior.

Tools Used

• Manual review

Recommendations

Validate Entire _weights Array:

Ensure that all elements in the _weights array are validated, irrespective of the _numberOfAssets. Modify the validation loop as follows: