Description

The vault token accounts vault_a and vault_b are initialized using the init attribute with associated token account seeds derived only from the token mint and liquidity pool authority. These seeds are predictable and not unique per pool initialization, allowing an attacker to pre-create (front-run) the vault accounts before the legitimate pool initialization.

Infected Code

Impact

Attackers can pre-initialize vault accounts, causing the pool initialization to fail and resulting in a denial of service by blocking new pool creation.

Recommendation and Fix

Use Program Derived Addresses (PDAs) with additional unique seeds such as the pool address or a nonce to generate vault accounts. This ensures vault account addresses are unique and cannot be pre-created by others.

Fixed Code Snippet