bad user can frontrun the pool creator and set the rule for the pool
Summary
Vulnerability Details
the setruleforpool function is used to set a rule for a pool
in the setruleforpool function a bad user can frontrun the pool creator and set the rule for the pool, since the setruleforpool function is callable by anyone
Impact
anyone being able to set the rule for a pool can lead to unexpected bahavior in the pool, such as incorrect pricing
Tools Used
manual
Recommendations
the poolcreater should ensure to set the rule for the pool while creating the pool or the setruleforpool function should be callable by only the pool creater to avoid being frontrunned
Lead Judging Commences
Informational or Gas / Admin is trusted / Pool creation is trusted / User mistake / Suppositions
Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.
Appeal created
Informational or Gas / Admin is trusted / Pool creation is trusted / User mistake / Suppositions
Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.