QuantAMM

QuantAMM
49,600 OP
View results
Submission Details
Severity: medium
Valid

Insufficient Validation in `onSwap` Function Allows Attackers to Bypass `maxTradeSizeRatio` Check

Title

Insufficient Validation in onSwap Function Allows Attackers to Bypass maxTradeSizeRatio Check

Summary

The onSwap function in the QuantAMMWeightedPool contract contains a logical error that the maxTradeSizeRatio check can be avoided by malicious actors.

Vulnerability Details

In detail, with SwapKind.EXACT_IN swaps, the check only restricts the input token amount, but no validation is performed on the output token amount. Whereas, with SwapKind.EXACT_OUT swaps, the check is applied to the output token amount.

Here's how SwapKind.EXACT_IN swaps were processed in QuantAMMWeightedPool contract:

function onSwap(PoolSwapParams memory request) public view onlyVault returns (uint256) {
...
if (request.kind == SwapKind.EXACT_IN) {
if (request.amountGivenScaled18 > request.balancesScaled18[request.indexIn].mulDown(maxTradeSizeRatio)) {
revert maxTradeSizeRatioExceeded();
}
uint256 amountOutScaled18 = WeightedMath.computeOutGivenExactIn(
request.balancesScaled18[request.indexIn],
tokenInWeight,
request.balancesScaled18[request.indexOut],
tokenOutWeight,
request.amountGivenScaled18
);
return amountOutScaled18;
} else {
...
}
}

This discrepency enables malicious actors to avoid the maxTradeSizeRatio check by and drain funds from the pool. It is a clear violation of the maxTradeSizeRatio invariant.

Impact

This vulnerability can lead to:

Token Draining
Attackers can manipulate trades to remove excessive amounts of a specific token from the pool.

Pool Imbalance
Disproportionate token ratios in the pool reduce its efficiency and liquidity.

Financial Risk
The lack of proper validation exposes the pool to potential manipulation, particularly in scenarios involving price spikes or market volatility

Tools Used

Manual Review

Recommendations

To address this issue, additional validation should be introduced for EXACT_IN swaps to ensure the output token amount adheres to the maxTradeSizeRatio.

Updates

Lead Judging Commences

n0kto Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_onSwap_exact_in_swap_check_input

Likelihood: Medium, any “exact_in” swap only if there is a price pike of one token. Impact: Medium, bypass the maxTradeSizeRatio check.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.