Summary

The UpliftOnlyExample hook serves as a router and manages liquidity deposits, NFT minting, and BPT tokens. However, it lacks an initialize function to properly initialize and deposit the first liquidity into a new pool. This omission can lead to scenarios where liquidity is initialized by an external router, creating issues for users attempting to withdraw liquidity due to the NFT check in onAfterRemoveLiquidity.

Vulnerability Details

• The UpliftOnlyExample hook does not include an initialize function to handle the initialization and first liquidity deposit for a newly registered pool. In balancer a new pool has to be initialized using the router to mint the initial minimum BPT to start it's operation

• This can be done by other routers but when a pool is initialized by another router, that user will not be able to withdraw their liquidity. The withdrawal process requires burning an NFT in onAfterRemoveLiquidity function. Since that user never got any NFT, he can never withdraw his funds.

• Without an NFT, the user who initialized the pool cannot withdraw their funds, creating a locking scenario due to mismatched initialization mechanisms.

Impact

The user who initializes the pool through another router will have their funds permanently locked.

Tools Used

Manual Code Review

Recommendations

Implement an initialize function within the UpliftOnlyExample hook similar to the initialize of Router.sol to handle initial liquidity deposit for new pools. Ensure this function incorporates the necessary NFT minting and checks.