QuantAMM

Summary

The onRegister function in the UpliftOnlyExample hook is called when a new pool is registered with the vault. However, the implementation lacks critical checks to validate that the pool originates from an allowed pool factory. This omission permits arbitrary pools to register with the hook, which could lead to misuse or unexpected behavior.

Vulnerability Details

• The onRegister function does not validate if the pool is created by an allowed pool factory. This is contrary to the best practices outlined in Balancer’s documentation, where it is recommended to ensure that pools from only authorized factories should register with the hook.

Impact

Unauthorized pools can exploit the hook, potentially leading to financial losses or system instability.

Tools Used

Manual Code Review

Recommendations

Update the onRegister function to validate that the factory is an allowed one and that the pool originates from the specified factory. Example - 1