QuantAMM

Summary

Loss of Pool Creator fee. To create a new pool we have create() function inside the QuantAMMWeightedPoolFactory.sol. In the function it checks whether the address of poolCreator is set to address(0).

Hence we have to set the poolCreator address as address(0). in the create() function we call another function _registerPoolWithVault() the fourth parameter we are passing it as false which is protocolFeeExempt. Means we want to collect the fee for this pool.

Vaults contract inherits from the ProtocolFeeController contract which manages fee of the pool. It has a function withdrawPoolCreatorFees() which is used to collect the fees and can be called by anyone but the fees goes to the pool creator. And when we create a pool we set the value to address(0) hence this collected fees goes to zero address and loss of rewards for the Pool Creator. This pool creator address can not be modify later which is also mentioned in the docs of Balancer - Link/

Vulnerability Details

1. The create() function enforces the poolCreator address to be address(0).

2. All fees accrued for the pool creator are sent to address(0) and are irrecoverable.

3. Balancer Documentation:
   - "The accrued creator fees can only be claimed by the poolCreator."
   - "The pool creator sets the poolCreator address during pool registration, which cannot be changed afterward."

Impact

Loss of creator fee for the protocol creator

Tools Used

Manual Review

Recommendations

Remove the check which forces to set the PoolCreator address to address(0).