First Flight #18: T-Swap

Summary

No check if the address of tokenAddress in createPool function exists

Vulnerability Details

The function createPool(address) does not have a way to verify if the pool exists (can be zero address or non-existing contract). A user can create a TSwapPool contract with non-deployed or zero address.

Impact

Tools Used

Manual Review

Recommendations

Code a way to verify if an address is a deployed contract (and != zero address). If it is not, revert with the existing PoolFactory__PoolDoesNotExist(address tokenAddress) error that is currently unused.