The onRegister
function in the UpliftOnlyExample
hook is called when a new pool is registered with the vault. However, the implementation lacks critical checks to validate that the pool originates from an allowed pool factory. This omission permits arbitrary pools to register with the hook, which could lead to misuse or unexpected behavior.
The onRegister
function does not validate if the pool is created by an allowed pool factory. This is contrary to the best practices outlined in Balancer’s documentation, where it is recommended to ensure that pools from only authorized factories should register with the hook.
Unauthorized pools can exploit the hook, potentially leading to financial losses or system instability.
Manual Code Review
Update the onRegister
function to validate that the factory is an allowed one and that the pool originates from the specified factory. Example - 1
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.