QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: medium
Valid

incorrect length check in `_setGradient` will DOS manual setting of `intermediateGradientState` after pool initialization

honour

Summary

The UpdateWeightRunner provides a function (setIntermediateValuesManually) that allows the QuantAMM admin to manually set the intermediate variables of a rule, asides from setting the initial intermediate variables on pool initialization , it can also be used as a break-glass feature to set/reset the intermediate variables of a rule if necessary.
The issue is that the length check in the function QuantAMMGradientBasedRule::_setGradient function is incorrect and will prevent usage of this feature

Vulnerability Details

In QuantAMMGradientBasedRule::_setGradient

function _setGradient(address poolAddress, int256[] memory _initialValues, uint _numberOfAssets) internal {
uint storeLength = intermediateGradientStates[poolAddress].length;
if ((storeLength == 0 && _initialValues.length == _numberOfAssets) || _initialValues.length == storeLength) { <@
//should be during create pool
intermediateGradientStates[poolAddress] = _quantAMMPack128Array(_initialValues);
} else {
revert("Invalid set gradient");
}
}

The issue is that intermediateGradientStates is a packed array with length = numberOfAssets/2 whereas initialValues is an array with length = numberOfAssets. This means that the function will always revert when storeLength is not 0(i.e. when pool is already initialized).

Impact

Medium - Break-glass feature, where the QuantAMM admin can manually set the intermediate gradients, will be unusable

Tools Used

Manual Review

Recommendations

function _setGradient(address poolAddress, int256[] memory _initialValues, uint _numberOfAssets) internal {
uint storeLength = intermediateGradientStates[poolAddress].length;
if ((storeLength == 0 && _initialValues.length == _numberOfAssets) || storeLength >= _initialValues.length/2) { <@
//should be during create pool
intermediateGradientStates[poolAddress] = _quantAMMPack128Array(_initialValues);
} else {
revert("Invalid set gradient");
}
}
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas / Admin is trusted / Pool creation is trusted / User mistake / Suppositions

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Appeal created

honour Submitter
10 months ago
honour Submitter
10 months ago
honour Submitter
10 months ago
n0kto Lead Judge
9 months ago
n0kto Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_setGradient_unusable_length_stored_new_values_are_different

Impact: Medium/High, the breakglass function is unusable. Likelihood: Low/Medium, when `setIntermediateValuesManually` is called by the admin to correct the intermediate values in case of any problem.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.