QuantAMM

Summary

The QuantAMMWeightedPoolFactory contract is designed to create and initialize new pools for the Balancer V3 protocol. It allows for flexible pool creation with multiple tokens, custom weights, and additional configuration parameters. It also includes two methods, createWithoutArgs and create, to handle the pool creation process.

Vulnerability Details

There is no access control implemented in the createWithoutArgs and create functions, meaning any address can call these functions and create pools.

Both the createWithoutArgs and create functions lack modifiers like onlyOwner or onlyAuthorized.

Impact

Malicious actors could create pools without any restrictions, leading to potential abuse or flooding the system with unwanted pools.

Tools Used

Manual Review

Recommendations

Use Ownable, AccessControl, or a similar access control mechanism to restrict who can create pools.

modifier onlyAuthorized() {
require(msg.sender == authorizedAddress, "Not authorized");
_;
}