QuantAMM

Title

Flawed Conditional in _setInitialMovingAverages Function May Result in Unintended Initialization of movingAverages.

Summary

The _setInitialMovingAverages function contains a flawed conditional statement using an OR operator, introducing ambiguity and potentially allowing unintended updates to movingAverages. This could result in incorrect or inconsistent behavior when setting initial values.

Vulnerability Details

Here's the implementation of _setInitialMovingAverages function in QuantammMathMovingAverage contract:

As seen above, OR operator is used in conditional statement.
If the movingAverageLength == 0 is true, _initialMovingAverages.length == _numberOfAssets would be ignored to pass the conditional. That means, the function may proceed to set moving averages for the specified pool without verifying that the provided initial averages match the expected number of assets.

Impact

Data Integrity Risk
The function may set moving averages with an incorrect number of values if _initialMovingAverages does not match _numberOfAssets, leading to invalid or inconsistent contract states.

Exploitation Risk
This vulnerability could be exploited by malicious actors or result in operational errors, compromising the reliability of the pool's data.

Tools Used

Manual Review

Recommendations

Use AND instead of OR in the conditional statement: