QuantAMM

QuantAMM
49,600 OP
View results
Submission Details
Severity: low
Invalid

Missing Pool Factory Validation in onRegister Function of UpliftOnlyExample Hook

Summary

The onRegister function in the UpliftOnlyExample hook is called when a new pool is registered with the vault. However, the implementation lacks critical checks to validate that the pool originates from an allowed pool factory. This omission permits arbitrary pools to register with the hook, which could lead to misuse or unexpected behavior.

Vulnerability Details

  • The onRegister function does not validate if the pool is created by an allowed pool factory. This is contrary to the best practices outlined in Balancer’s documentation, where it is recommended to ensure that pools from only authorized factories should register with the hook.

Impact

Unauthorized pools can exploit the hook, potentially leading to financial losses or system instability.

Tools Used

Manual Code Review

Recommendations

Update the onRegister function to validate that the factory is an allowed one and that the pool originates from the specified factory. Example - 1

Updates

Lead Judging Commences

n0kto Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.