QuantAMM

Summary

The setRuleForPool function allows the assignment of a rule to a pool, but once a rule is set, it cannot be updated or removed.

This limitation could lead to operational issues if the rule needs to be modified due to changes in the system, bug fixes, or evolving business requirements.

Vulnerability Details

In UpdateWeightRunner.sol, No function exists to update a rule once set

Even the quantammAdmin cannot modify or remove a problematic rule

If a bug is found in a rule's implementation, the pool would be permanently stuck with that rule

Impact

Pools cannot adapt to changing conditions or updated business requirements.

If a rule is found to be insecure or faulty, the system could remain vulnerable due to the inability to replace the rule.

To replace rules, the entire pool might need to be redeployed, causing unnecessary downtime and complexity.

Recommendations

Add admin functionality to update rules with appropriate safeguards