QuantAMM

Summary

The QuantAMMWeightedPool constructor and initialize function do not implement any check to ensure that the deployer and initializer of the QuantAMMWeightedPool contract are the QuantAMMWeightedPoolFactory contract.

Vulnerability Details

A malicious user can deploy its own pool with their own parameters and weights not through factory contract.

The QuantAMMWeightedPool contract can be deployed and initialized by anyone. It does not include any checks to verify that the deployment is done through the factory contract.

A malicious user could deploy the QuantAMMWeightedPool contract and initialize it with their own parameters and weights.

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-quantamm/contracts/QuantAMMWeightedPool.sol#L694

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-quantamm/contracts/QuantAMMWeightedPool.sol#L175

Impact

Users of this malicious pool could be rug-pulled and their tokens and funds could be compromised, as the malicious pool could operate with unauthorized parameters and weights.

Tools Used

Manual Review

Recommendations

To mitigate the bug, you can implement the following changes:

1. Add a check in the constructor to ensure the contract is deployed through the QuantAMMWeightedPoolFactory:

2.Add a check in the starting of initialize function to ensure the initializer is the QuantAMMWeightedPoolFactory contract :