Description

The InitializePool instruction accepts a creator account marked as a signer, but it does not verify whether the creator is an authorized admin or a valid participant. There is no access control or whitelist mechanism restricting who can create new liquidity pools.

Infected Code

Impact

Without validation on the creator, anyone can create liquidity pools arbitrarily. This can lead to:

• Creation of pools with manipulated token ratios or parameters designed to deceive users or create unfair trading conditions.

• Potential manipulation or fragmentation of liquidity across many pools, undermining the protocol’s integrity and governance mechanisms.

Recommendation

Implement access control to restrict pool creation to authorized users. One approach is to maintain an on-chain list (e.g., a PDA account) of approved creators and verify against it in the instruction.

Fixed Code Example