QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Hardcoded `"version"` String Instead of `_poolVersion` Breaks Balancer V3 Version Control

0xhuntoor

Summary

The create() and createWithoutArgs() functions in QuantAMMWeightedPoolFactory passes a hardcoded "version" string instead of using the stored _poolVersion variable when creating new pools, breaking version control and traceability in the Balancer V3 ecosystem.

Vulnerability Details

pool = _create(abi.encode(
QuantAMMWeightedPool.NewPoolParams({
name: params.name,
symbol: params.symbol,
numTokens: params.normalizedWeights.length,
version: "version", // Should use _poolVersion
updateWeightRunner: _updateWeightRunner,
poolRegistry: params.poolRegistry,
poolDetails: params.poolDetails
}),
getVault()

Key issues:

  1. Hardcoded "version" string ignores the contract's _poolVersion state variable

  2. Breaks Balancer V3's versioning system for pool tracking

  3. Makes it impossible to track different pool versions on-chain

  4. Complicates protocol upgrades and maintenance

Impact

  1. Breaks version control system

  2. Makes pool version tracking impossible

  3. Affects protocol integration capabilities

Tools Used

  • Manual code review

Recommendations

  1. Use the stored version variable:

pool = _create(abi.encode(
QuantAMMWeightedPool.NewPoolParams({
name: params.name,
symbol: params.symbol,
numTokens: params.normalizedWeights.length,
version: _poolVersion, // Use stored version
updateWeightRunner: _updateWeightRunner,
poolRegistry: params.poolRegistry,
poolDetails: params.poolDetails
}),
getVault()

  1. Add version management functions:

function setPoolVersion(string memory newVersion) external {
require(msg.sender == admin, "Only admin");
_poolVersion = newVersion;
emit PoolVersionUpdated(newVersion);
}
​
function getPoolVersion() external view returns (string memory) {
return _poolVersion;
}

This enables:

  • Proper version tracking

  • Compatibility with Balancer V3 standards

  • Better protocol maintenance

  • Improved upgrade management

Updates

Lead Judging Commences

n0kto Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

invalid_hardcoded_version

Version is immutable as specified in Version.sol and can be what the developer wants. It is hardcoded and will be changed by the admin for every deployment. No real impact here.

Appeal created

0xhuntoor Submitter
7 months ago
n0kto Lead Judge
7 months ago
n0kto Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

invalid_hardcoded_version

Version is immutable as specified in Version.sol and can be what the developer wants. It is hardcoded and will be changed by the admin for every deployment. No real impact here.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.