QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Total Weight Overflow Vulnerability in Pool Weight Management

nitinaimshigh

Summary

/// @notice Breakglass function to allow the admin or the pool manager to set the quantammAdmins weights manually
/// @param _weights the new weights
/// @param _poolAddress the target pool
/// @param _lastInterpolationTimePossible the last time that the interpolation will work
/// @param _numberOfAssets the number of assets in the pool
function setWeightsManually(
int256[] calldata _weights,
address _poolAddress,
uint40 _lastInterpolationTimePossible,
uint _numberOfAssets
) external {
uint256 poolRegistryEntry = QuantAMMWeightedPool(_poolAddress).poolRegistry();
if (poolRegistryEntry & MASK_POOL_OWNER_UPDATES > 0) {
require(msg.sender == poolRuleSettings[_poolAddress].poolManager, "ONLYMANAGER");
} else if (poolRegistryEntry & MASK_POOL_QUANTAMM_ADMIN_UPDATES > 0) {
require(msg.sender == quantammAdmin, "ONLYADMIN");
} else {
revert("No permission to set weight values");
}
​
//though we try to keep manual overrides as open as possible for unknown unknows
//given how the math library works weights it is easiest to define weights as 18dp
//even though technically G3M works of the ratio between them so it is not strictly necessary
//CYFRIN L-02
for (uint i; i < _weights.length; i++) {
if (i < _numberOfAssets) {
require(_weights[i] > 0, "Negative weight not allowed");
require(_weights[i] < 1e18, "greater than 1 weight not allowed");
}
}
​
IQuantAMMWeightedPool(_poolAddress).setWeights(_weights, _poolAddress, _lastInterpolationTimePossible);
​
emit SetWeightManual(msg.sender, _poolAddress, _weights, _lastInterpolationTimePossible);
}

The setWeightsManually function lacks comprehensive checks or limits on the total sum of weights across the assets in the pool.

Vulnerability Details

The setWeightsManually function is not checking if the sum of weights is exceeding certain value, most likely 1e18. This will result in wrong weights allocations.

Suppose three weights need to be allotted and they are 1e18, 2e18 & 3e18. It checks individually for each weight:

for (uint i; i < _weights.length; i++) {
if (i < _numberOfAssets) {
require(_weights[i] > 0, "Negative weight not allowed");
require(_weights[i] < 1e18, "greater than 1 weight not allowed");
}
}

However, it is not checking if the sum of weights is less than 1e18.

Impact

This could result in issues in it's functionality(eg. wrong price allocation)

Tools Used

Manual Review

Recommendations

Add a check to ensure that the sum of the weights does not exceed a maximum value (such as 1e18).

Updates

Lead Judging Commences

n0kto Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

invalid_sum_of_weights_can_exceeds_one_no_guard

According the sponsor and my understanding, sum of weights does not have to be exactly 1 to work fine. So no real impact here. Please provide a PoC showing a realistic impact if you disagree. This PoC cannot contains negative weights because they will be guarded per clampWeights.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.