Submission Details
Severity:
Wrong version for pool
Summary
Both createWithoutArgs and create in QuantAMMWeightedPoolFactory are using wrong version. Instead of passing the _poolVersion, it is used a hardcoded string version.
Impact
Wrong pool version will be populated for all of the created pools by this factory.
Tools Used
Manual review
Recommendations
Refactor the code in the following way:
poolArgs = abi.encode(
QuantAMMWeightedPool.NewPoolParams({
name: params.name,
symbol: params.symbol,
numTokens: params.normalizedWeights.length,
+ version: _poolVersion,
- version: "version",
updateWeightRunner: _updateWeightRunner,
poolRegistry: params.poolRegistry,
poolDetails: params.poolDetails
}),
getVault()
);
Updates
Lead Judging Commences
n0kto 7 months ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
invalid_hardcoded_version
Version is immutable as specified in Version.sol and can be what the developer wants. It is hardcoded and will be changed by the admin for every deployment. No real impact here.
Prize pool breakdown
Total prize
49,600 OP
nSLOC
3,00017 OP / LOC
44,640
4,960
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.