QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Hardcoded pool version string breaks factory's version control system

0xtheblackpanther

Summary

The QuantAMMWeightedPool factory stores a version string in its constructor but does not use it when creating pools. Instead, it passes a hardcoded "version" string to all created pools, making version tracking ineffective.

// Constructor stores version properly
constructor(..., string memory poolVersion) {
_poolVersion = poolVersion;
}
​
// But create functions use hardcoded string
pool = _create(abi.encode(
QuantAMMWeightedPool.NewPoolParams({
...
version: "version", // Hardcoded instead of using _poolVersion @audit ❌
...
}),
getVault()
), params.salt);

Impact

The hardcoded version string breaks version tracking and management. Protocol teams cannot reliably track or update pools, potentially leaving user funds at risk during upgrades or emergency situations.

When every pool shows the same version "version", it's like having a library where all books show the same publication date - you can't tell which ones need updates, potentially leaving security vulnerabilities unfixed.

Proof of concept

Add testVersionMismatchin pkg/pool-quantamm/test/foundry/QuantAMMWeightedPoolFactory.t.soland import import { Version } from "@balancer-labs/v3-solidity-utils/contracts/helpers/Version.sol"; then run the test :)

function testVersionMismatch() public {
// Setup tokens and rate providers
address[] memory tokens = new address[]();
tokens[0] = address(dai);
tokens[1] = address(usdc);
IRateProvider[] memory rateProviders = new IRateProvider[]();
​
// Get params using helper
QuantAMMWeightedPoolFactory.NewPoolParams memory params = _createPoolParams(tokens, rateProviders);
​
// Deploy pools using existing factory from setUp
(address pool,) = quantAMMWeightedPoolFactory.create(params);
​
// Version check
string memory factoryVersion = quantAMMWeightedPoolFactory.getPoolVersion();
string memory poolVersion = Version(pool).version();
​
assertEq(factoryVersion, "Pool v1", "Factory version wrong");
assertEq(poolVersion, "version", "Pool version not hardcoded");
}

Recommendation

Replace the hardcoded version string with the stored _poolVersion:

pool = _create(abi.encode(
QuantAMMWeightedPool.NewPoolParams({
...
version: _poolVersion, // Use stored version ✅
...
}),
getVault()
), params.salt);
Updates

Lead Judging Commences

n0kto Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

invalid_hardcoded_version

Version is immutable as specified in Version.sol and can be what the developer wants. It is hardcoded and will be changed by the admin for every deployment. No real impact here.

Appeal created

0xtheblackpanther Submitter
4 months ago
n0kto Lead Judge
4 months ago
n0kto Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

invalid_hardcoded_version

Version is immutable as specified in Version.sol and can be what the developer wants. It is hardcoded and will be changed by the admin for every deployment. No real impact here.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.