QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: medium
Valid

incorrect length check in `_setIntermediateVariance` will DOS manual setting of `intermediateVarianceStates` after pool initialization

honour

Summary

The UpdateWeightRunner provides a function (setIntermediateValuesManually) that allows the QuantAMM admin to manually set the intermediate variables of a rule, asides from setting the initial intermediate variables on pool initialization , it can also be used as a break-glass feature to set/reset the intermediate variables of a rule if necessary.
The issue is that the length check in the function QuantAMMVarianceBasedRule::_setIntermediateVariance function is incorrect and will prevent usage of this feature

Vulnerability Details

In QuantAMMVarianceBasedRule::_setIntermediateVariance

function _setIntermediateVariance(
address _poolAddress,
int256[] memory _initialValues,
uint _numberOfAssets
) internal {
uint storeLength = intermediateVarianceStates[_poolAddress].length;
​
if ((storeLength == 0 && _initialValues.length == _numberOfAssets) || _initialValues.length == storeLength) { <@
//should be during create pool
intermediateVarianceStates[_poolAddress] = _quantAMMPack128Array(_initialValues);
} else {
revert("Invalid set variance");
}
}

The issue is that intermediateVarianceStates is a packed array with length = numberOfAssets/2 whereas initialValues is an array with length = numberOfAssets. This means that the function will always revert when storeLength is not 0(i.e. when pool is already initialized).

Impact

Medium - Break-glass feature, where the QuantAMM admin can manually set the intermediate variance if necessary, will be unusable

Tools Used

Manual Review

Recommendations

function _setIntermediateVariance(
address _poolAddress,
int256[] memory _initialValues,
uint _numberOfAssets
) internal {
uint storeLength = intermediateVarianceStates[_poolAddress].length;
​
if ((storeLength == 0 && _initialValues.length == _numberOfAssets) || storeLength * 2 >= _initialValues.length) { <@
//should be during create pool
intermediateVarianceStates[_poolAddress] = _quantAMMPack128Array(_initialValues);
} else {
revert("Invalid set variance");
}
}
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding__setIntermediateVariance_unusable_length_stored_new_values_are_different

Likelihood: Medium, _setIntermediateVariance is used to correct values in case of problem. Impact: Low/Medium, First initialization will work but this function won’t be able to mitigate any future problem.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!