Summary

The createPool function does not validate the tokenAddress parameter, which could lead to the creation of pools with invalid or malicious token addresses.

Vulnerability Details

The absence of validation for the tokenAddress parameter means that any address, including invalid or malicious ones, can be used to create a pool. This can result in several issues, such as creating pools with non-existent tokens or tokens that do not conform to the expected ERC20 standard.

Impact

• Creation of pools with invalid token addresses, causing failures or unexpected behavior.

• Potential security vulnerabilities if a malicious address is used.

• Difficulty in managing and interacting with pools created with invalid tokens.

Tools Used

Manual Inspection

Recommendations

Implement validation for the tokenAddress parameter to ensure it is a valid ERC20 token address.