QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: medium
Valid

incorrect length check in `_setIntermediateVariance` will DOS manual setting of `intermediateVarianceStates` after pool initialization

honour

Summary

The UpdateWeightRunner provides a function (setIntermediateValuesManually) that allows the QuantAMM admin to manually set the intermediate variables of a rule, asides from setting the initial intermediate variables on pool initialization , it can also be used as a break-glass feature to set/reset the intermediate variables of a rule if necessary.
The issue is that the length check in the function QuantAMMVarianceBasedRule::_setIntermediateVariance function is incorrect and will prevent usage of this feature

Vulnerability Details

In QuantAMMVarianceBasedRule::_setIntermediateVariance

function _setIntermediateVariance(
address _poolAddress,
int256[] memory _initialValues,
uint _numberOfAssets
) internal {
uint storeLength = intermediateVarianceStates[_poolAddress].length;
​
if ((storeLength == 0 && _initialValues.length == _numberOfAssets) || _initialValues.length == storeLength) { <@
//should be during create pool
intermediateVarianceStates[_poolAddress] = _quantAMMPack128Array(_initialValues);
} else {
revert("Invalid set variance");
}
}

The issue is that intermediateVarianceStates is a packed array with length = numberOfAssets/2 whereas initialValues is an array with length = numberOfAssets. This means that the function will always revert when storeLength is not 0(i.e. when pool is already initialized).

Impact

Medium - Break-glass feature, where the QuantAMM admin can manually set the intermediate variance if necessary, will be unusable

Tools Used

Manual Review

Recommendations

function _setIntermediateVariance(
address _poolAddress,
int256[] memory _initialValues,
uint _numberOfAssets
) internal {
uint storeLength = intermediateVarianceStates[_poolAddress].length;
​
if ((storeLength == 0 && _initialValues.length == _numberOfAssets) || storeLength * 2 >= _initialValues.length) { <@
//should be during create pool
intermediateVarianceStates[_poolAddress] = _quantAMMPack128Array(_initialValues);
} else {
revert("Invalid set variance");
}
}
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding__setIntermediateVariance_unusable_length_stored_new_values_are_different

Likelihood: Medium, _setIntermediateVariance is used to correct values in case of problem. Impact: Low/Medium, First initialization will work but this function won’t be able to mitigate any future problem.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.