QuantAMM

Summary

The setWeights function fails to enforce the normalized weight invariant, which ensures that the sum of weights equals FixedPoint.ONE.

This check is present in the _setInitialWeights function but is missing in setWeights, creating a significant inconsistency.

Without this check, invalid weight updates can disrupt the pool’s behavior, potentially causing incorrect balance calculations and trading operations.

Vulnerability Details

In the _setInitialWeights function, the contract ensures the sum of weights equals FixedPoint.ONE:

However, in the setWeights function, there is no equivalent check to validate the updated weights:

The lack of this validation means that the weights could sum to a value other than FixedPoint.ONE, breaking the invariant that the pool depends on for its calculations.

Impact

The absence of normalized weights can lead to invalid balance calculations, disrupting the pool's trading and weight adjustment logic.

Recommendations

To address this vulnerability, add a validation check in the setWeights function to ensure the sum of weights equals FixedPoint.ONE