QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Unvalidated pool registry values in QuantAMMWeightedPool constructor

zubyoz

Summary

The QuantAMMWeightedPool contract's constructor accepts a poolRegistry parameter without validating its value against known valid configurations. Since this value is stored as an immutable state variable and controls administrative functionality, an incorrect value could lead to misconfigured pool permissions that cannot be corrected without redeployment.

Vulnerability Details

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-quantamm/contracts/QuantAMMWeightedPool.sol#L182

constructor(
NewPoolParams memory params,
IVault vault
) BalancerPoolToken(vault, params.name, params.symbol) PoolInfo(vault) Version(params.version) {
_totalTokens = params.numTokens;
updateWeightRunner = UpdateWeightRunner(params.updateWeightRunner);
quantammAdmin = updateWeightRunner.quantammAdmin();
poolRegistry = params.poolRegistry; // @audit No validation of poolRegistry value
// ...
}

The poolRegistry is declared as an immutable state variable:

uint256 public immutable poolRegistry;

Impact

The poolRegistry value determines administrative functionality for the pool
Once set, it cannot be modified due to its immutable nature
Incorrect values could lead to:
Misconfigured administrative permissions
Unintended access control settings
Requirement for pool redeployment to fix issues
While this doesn't directly impact user funds, it affects pool governance and management capabilities

Tools Used

Manual Review

Recommendations

  1. Define valid pool registry configurations as constants:

contract QuantAMMWeightedPool {
uint256 public constant ADMIN_ROLE_FULL = 1;
uint256 public constant ADMIN_ROLE_LIMITED = 2;
uint256 public constant ADMIN_ROLE_MINIMAL = 3;
​
constructor(
NewPoolParams memory params,
IVault vault
) BalancerPoolToken(vault, params.name, params.symbol) PoolInfo(vault) Version(params.version) {
// Validate pool registry
require(
params.poolRegistry == ADMIN_ROLE_FULL ||
params.poolRegistry == ADMIN_ROLE_LIMITED ||
params.poolRegistry == ADMIN_ROLE_MINIMAL,
"Invalid pool registry configuration"
);
poolRegistry = params.poolRegistry;
// ...
}
}
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas / Admin is trusted / Pool creation is trusted / User mistake / Suppositions

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!