The QuantAMMWeightedPoolFactory
uses incorrect version to create the pool, which circumvents its intended purpose, leading to potential issues in identifying contract versions and any relevant changes or updates that occurred over time.
In QuantAMMWeightedPoolFactory
contract, the createWithoutArgs
and create
functions are using the hardcoded string version
to create the QuantAMMWeightedPool
pool:
The QuantAMMWeightedPool
extends from Version
. The comment in the Version
contract specifies that the version should take the form of JSON strings containing detailed deployment information:
However, the code simply assigns a string "version"
to the version parameter without providing any meaningful or structured information.
This creates a logical inconsistency because the version management system is expected to hold detailed deployment metadata that allows for tracking and auditing of contract versions. By using a generic, hard-coded string, it circumvents its intended purpose, leading to potential issues in identifying contract versions and any relevant changes or updates that occurred over time. The lack of structured versioning information can also enable version confusion, where administrators or users may not be able to discern the actual behavior or state of the contracts.
The impact is LOW and the likelihood is HIGH, so the severity is LOW.
Manual Review
In balancer-v3-monorepo, the WeightedPoolFactory
will use _poolVersion
to create the pool, see the code here:
So consider using the _poolVersion
instead:
Version is immutable as specified in Version.sol and can be what the developer wants. It is hardcoded and will be changed by the admin for every deployment. No real impact here.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.