Initial deposit zero poolTokens
Summary
Initial deposit can be frontrun by attacker and deposit some amount of weth and zero amount of poolToken, this is going to break the pool and users cannot swap or withdraw
Vulnerability Details
The deposit function does not care if the initial depositor is depositing any amount of poolToken.
Any operation on the pool (swap, withdraw) will fail if the poolToken reserve is zero.
But liquidity providers can still provide liquidity which is going to be locked in the pool.
Impact
Pool not usable.
Liquidity is locked in the pool.
Tools Used
Unit test.
Recommendations
In the initial deposit, check if the deposited amounts are not zero.
Appeal created
_addLiquidityMintAndTransfer function does not check if poolTokensToDeposit is zero.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.