First Flight #18: T-Swap

Summary

The PoolFactory contract is designed to create and manage liquidity pools within a decentralized finance ecosystem. However, it currently lacks functionality to track the pools it has created. This missing feature can lead to significant operational and security issues within the ecosystem.

Vulnerability Details

The PoolFactory contract should maintain a record of all liquidity pools it creates to ensure proper management and security monitoring. Without tracking, the contract cannot provide a comprehensive view of the pools, making it challenging to:

1. Audit the number and status of pools.

2. Retrieve and manage pools efficiently.

3. Implement security measures, such as detecting and responding to anomalies across pools.

This lack of tracking also hinders transparency for users who rely on the factory to access information about existing liquidity pools.

Impact

1. Operational Inefficiency: Administrators and users cannot efficiently manage or interact with liquidity pools without a comprehensive registry.

2. Security Risks: Potential security vulnerabilities may go unnoticed without the ability to monitor all pools created by the factory contract.

Proof of Concept (PoC):

1. Deploy the PoolFactory contract.

2. Use the PoolFactory contract to create multiple liquidity pools.

3. Attempt to retrieve a list of all created pools from the PoolFactory contract.

4. Observe that there is no built-in functionality to track or retrieve the list of created pools.

Tools Used

Manual Review

Recommendations

1. Implement Pool Tracking: Modify the PoolFactory contract to include functionality for tracking created pools. This can be achieved by maintaining an array or mapping of pool addresses within the contract.

2. Add Pool Creation Event: Emit an event whenever a new pool is created. This allows external systems and users to listen for pool creation events and maintain their own records if needed.

3. Provide Management Functions: Implement functions to retrieve the list of all pools, count of pools, and other relevant details to enhance manageability and transparency.