QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Pool version control bypassed due to hardcoded version string

goran

Summary

The QuantAMMWeightedPoolFactory contract stores a pool version in a storage variable _poolVersion that is set during construction, but this version is never used. Instead, pool creation uses a hardcoded string "version", bypassing version control and making on-chain pool version tracking impossible.

Vulnerability Details

The factory properly initializes version in constructor:

constructor(
IVault vault,
uint32 pauseWindowDuration,
string memory factoryVersion,
string memory poolVersion, // Version passed in constructor
address updateWeightRunner
) BasePoolFactory(vault, pauseWindowDuration, type(QuantAMMWeightedPool).creationCode) Version(factoryVersion) {
_poolVersion = poolVersion; // Stored in state variable
...
}

However, during pool creation, a hardcoded string is used instead:

pool = _create(abi.encode(
QuantAMMWeightedPool.NewPoolParams({
name: params.name,
symbol: params.symbol,
numTokens: params.normalizedWeights.length,
// hardcoded string instead of _poolVersion
version: "version",
updateWeightRunner: _updateWeightRunner,
poolRegistry: params.poolRegistry,
poolDetails: params.poolDetails
}),
getVault()
), params.salt);

The factory even implements IPoolVersion interface with unused getter:

function getPoolVersion() external view returns (string memory) {
return _poolVersion; // Returns correct version but it's never used
}

Impact

  • Pool version tracking becomes unreliable

  • All pools report same hardcoded version regardless of actual implementation

  • Impossible to track pool versions for on-chain dynamic integration

  • Medium severity as it affects protocol maintenance but not direct functionality

Tools Used

Manual code review

Recommendations

Use the stored version instead of hardcoded string:

pool = _create(abi.encode(
QuantAMMWeightedPool.NewPoolParams({
name: params.name,
symbol: params.symbol,
numTokens: params.normalizedWeights.length,
version: _poolVersion, // Use stored version
updateWeightRunner: _updateWeightRunner,
poolRegistry: params.poolRegistry,
poolDetails: params.poolDetails
}),
getVault()
), params.salt);

This ensures proper version tracking and maintains consistency with the IPoolVersion interface implementation.

Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

invalid_hardcoded_version

Version is immutable as specified in Version.sol and can be what the developer wants. It is hardcoded and will be changed by the admin for every deployment. No real impact here.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!