QuantAMM

Summary

In UpdateWeightRunner there is a function setRuleForPool which should be called by a pool for registering the pool. However, currently there is no access control on this function and anyone can call it and register their address or their contract's address as a legit pool.

Vulnerability Details

Anyone can call setRuleForPool which will register their contract as a real pool on the UpdateWeightRunner contract's storage.

This will lead to problems in:

1. calculateMultiplierAndSetWeightsFromRule should not be called by anyone else except rules. When everyone is able to register a rule this does not work.

2. As stated in InitialisePoolLastRunTime,setWeightsManually and setIntermediateValuesManually "Current breakglass settings allow pool creator trigger. This is subject to review". Currently when everyone can set register a pool/rule these breakglass settings are callable by everyone.

Impact

Malicious calls to the functions listed above. All four functions are connected to important settings that should not be callable by everyone.

Tools Used

Manual Review

Recommendations

Implement a whitelist for pools and add such a check in the setRuleForPool function thus blocking everyone from registering their own contract as a pool.