# There is no enforcement of the delay when calling updateweights in omnipoolcontroller.sol

OmnipoolController.updateWeights lacks a delay enforcement, letting privileged weight changes be timed to game rebalancing rewards and inflate depositor GEM payouts.

- Payout: Contest reward
- Severity: medium
- Program: Opal
- Credited: dirtymic
- Disclosed: 2024-03-30
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_opal_feb2024.pdf#3.3.9
- Library page: https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.3.9
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** OmnipoolController.updateWeights / Omnipool rebalancing reward
**Root cause:** updateWeights can be called at any time with no enforced delay between weight updates, so weights can be manipulated right before a deposit to maximize the deviation-based rebalancing reward.
**Steps:**
1. Deploy test with Omnipool and OmnipoolController; user approves USDC to omnipool.
2. User calls `omnipool.deposit(10_000e6, 1)` and `skip(14 days)`.
3. Privileged `opal` calls `controller.updateWeights(poolAddress, newWeights)` setting weights (e.g. TRI_POOL 0.8e18, USDC_STG 0.2e18, USDC_DOLA 0).
4. `skip(1 hours)`; assert `omnipool.rebalancingRewardActive()` is true.
5. Snapshot; user deposits again; observe `computeTotalDeviation()` drops and GEM reward balance increases.
6. Revert; `opal` calls `updateWeights` with skewed weights (0.3/0.3/0.4) immediately before user deposit; user's GEM reward exceeds the non-gamed case.
**How found:** Reviewer noticed updateWeights had no delay/timelock check and hypothesized weights could be set arbitrarily to manipulate the deviation-based rebalancing reward, then wrote a Foundry test comparing gamed vs normal deposit rewards.
**Exploitation:** A weight update timed just before a deposit shifts pool deviation so the depositor captures outsized rebalancing rewards; the PoC shows the gamed user's GEM balance exceeding a regular depositor's.
**Insight:** When a reward formula depends on pool state (deviation/weights), check whether the state-mutating admin function has a timelock; if not, simulate setting weights immediately before a deposit to see if rewards can be inflated.