First Flight #18: T-Swap

Summary

Uninitialized state variables in PoolFactory contract.

Vulnerability Details

PoolFactory::s_pools (src/PoolFactory.sol#27) is never initialized. It is used in:
- PoolFactory.createPool(address) (src/PoolFactory.sol#47-58)
- PoolFactory.getPool(address) (src/PoolFactory.sol#63-65)
PoolFactory::s_tokens (src/PoolFactory.sol#28) is never initialized. It is used in:
- PoolFactory.getToken(address) (src/PoolFactory.sol#67-69)

Impact

Anyone can create a pool, potentially leading to spam or malicious pools.

Tools Used

Slither

Recommendations

Initialize all the variables. If a variable is meant to be initialized to zero, explicitly set it to zero to improve code readability.