QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Break in version in QuantAMMWeightedPoolFactory

sabit

Summary

The QuantAMMWeightedPoolFactory contract contains a version tracking inconsistency where pool creation functions use a hardcoded version string instead of the stored pool version.

Vulnerability Details

Here's the current implementation:

// State variable set in constructor
string private _poolVersion;
​
// Pool creation functions using hardcoded version
pool = _create(abi.encode(
QuantAMMWeightedPool.NewPoolParams({
// ... other parameters
version: "version", // Hardcoded instead of using _poolVersion
// ... other parameters
}),
getVault()
), params.salt);
​

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-quantamm/contracts/QuantAMMWeightedPoolFactory.sol#L60

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-quantamm/contracts/QuantAMMWeightedPoolFactory.sol#L100

The _poolVersion is set in the constructor:

constructor(
IVault vault,
uint32 pauseWindowDuration,
string memory factoryVersion,
string memory poolVersion,
address updateWeightRunner
) BasePoolFactory(vault, pauseWindowDuration, type(QuantAMMWeightedPool).creationCode) Version(factoryVersion) {
require(updateWeightRunner != address(0), "update weight runner cannot be default address");
_poolVersion = poolVersion;
_updateWeightRunner = updateWeightRunner;
}
​

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-quantamm/contracts/QuantAMMWeightedPoolFactory.sol#L76

However, as it is, getPoolVersion() will return different version than what pools are created with. And tjos creates discrepancy between queried and actual versions.

function getPoolVersion() external view returns (string memory) {
return _poolVersion;
}

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-quantamm/contracts/QuantAMMWeightedPoolFactory.sol#L81C3-L83C6

The pool creation functions ignore the _poolVersion state variable and use a hardcoded "version" string instead.

Impact

Pools are created with incorrect version information and getPoolVersion() will return different version than what pools are created with.

Tools Used

Manual review

Recommendations

Replace hardcoded version with _poolVersion. Also add version validation in pool creation functions.

pool = _create(abi.encode(
QuantAMMWeightedPool.NewPoolParams({
// ... other parameters
version: _poolVersion, // Use stored version
// ... other parameters
}),
getVault()
), params.salt);
​
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

invalid_hardcoded_version

Version is immutable as specified in Version.sol and can be what the developer wants. It is hardcoded and will be changed by the admin for every deployment. No real impact here.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!