QuantAMM

Summary

A vulnerability exists in the VectorRuleQuantAMMStorage contract's _quantAMMPack128Matrix function where the last storage slot handling leads to data corruption. Here is the vulnerable code block from the contract:

https://github.com/Cyfrin/2024-12-quantamm/blob/main/pkg/pool-quantamm/contracts/QuantAMMStorage.sol#L373

The issue occurs because when packing matrices with an odd total number of elements (e.g. a 3x3 matrix which has 9 elements), the function attempts to handle the last element by directly overwriting the entire last storage slot (256 bits) with just the final matrix value cast to int256. This is incorrect because:

1. The function is meant to pack pairs of 128-bit integers into each 256-bit slot:

1. But for the last element in odd-sized matrices, it overwrites both halves:

This directly corrupts the packed matrix data that the QuantAMM system relies on for its covariance calculations and pool weight updates. The corruption is especially severe because:

Impact

In the QuantAMM system, the corruption of packed matrix data has severe implications for core functionality. When storing odd-sized matrices, the improper overwriting of the final storage slot's left 128 bits permanently destroys valid covariance matrix elements. This corrupted data then flows directly into _calculateQuantAMMCovariance(), where it's used for weight calculations and price determination. Since covariance matrices are fundamental to the AMM's pricing model, this corruption leads to incorrect asset valuations, improper liquidity provision, and potentially significant monetary losses. The issue is particularly dangerous because it occurs silently - the system continues operating with corrupted values, making detection difficult until financial discrepancies become apparent.

Recommended Mitigation Steps

Modify the storage write operation to preserve the left 128 bits when handling odd-numbered matrices: