SSSwap

First Flight #41
Beginner FriendlyRust
100 EXP
View results
Submission Details
Severity: medium
Valid

Initialization Order Issue Causing `lp_mint` Account Creation to Fail

Description

In the InitializePool instruction, the lp_mint account is being initialized with seeds that include the liquidity_pool key. However, the liquidity_pool account itself is also being initialized in the same instruction after lp_mint. Since liquidity_pool is not yet created and assigned a key at the time lp_mint is initialized, using its key as a seed causes the lp_mint account initialization to fail.

Additionally, Anchor validates and reads accounts sequentially in the order they are declared in the accounts struct — from top to bottom. Since lp_mint appears before liquidity_pool in the accounts struct, Anchor attempts to initialize lp_mint before liquidity_pool is available, causing the seed derivation to break.

Infected Code

#[account(
init,
payer = creator,
seeds = [b"lp_mint", liquidity_pool.key().as_ref()],
bump,
mint::decimals = LP_TOKEN_DECIMALS,
mint::authority = liquidity_pool,
mint::token_program = token_program
)]
pub lp_mint: InterfaceAccount<'info, Mint>,
#[account(
init_if_needed,
payer = creator,
associated_token::mint = lp_mint,
associated_token::authority = creator,
)]
pub creator_lp_token_account: InterfaceAccount<'info, TokenAccount>,
// ... other accounts ...
#[account(
init,
payer = creator,
space = ANCHOR_DISCRIMINATOR + LiquidityPool::INIT_SPACE,
seeds = [b"pool", token_mint_a.key().as_ref(), token_mint_b.key().as_ref()],
bump
)]
pub liquidity_pool: Account<'info, LiquidityPool>,

Impact

Because lp_mint initialization depends on the yet-to-be-created liquidity_pool account, the program will fail during account creation, causing the entire transaction to revert. This breaks pool initialization and prevents the protocol from creating new liquidity pools successfully.

Recommendation

Reorder the accounts in the struct so that liquidity_pool is declared before lp_mint. This ensures the liquidity_pool account is initialized and its key available before lp_mint initialization runs. Example:

#[account(
init,
payer = creator,
space = ANCHOR_DISCRIMINATOR + LiquidityPool::INIT_SPACE,
seeds = [b"pool", token_mint_a.key().as_ref(), token_mint_b.key().as_ref()],
bump
)]
pub liquidity_pool: Account<'info, LiquidityPool>,
#[account(
init,
payer = creator,
seeds = [b"lp_mint", liquidity_pool.key().as_ref()],
bump,
mint::decimals = LP_TOKEN_DECIMALS,
mint::authority = liquidity_pool,
mint::token_program = token_program
)]
pub lp_mint: InterfaceAccount<'info, Mint>,

This adjustment respects Anchor’s sequential account initialization and fixes the seed derivation issue.

Updates

Lead Judging Commences

0xtimefliez Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

Initialization of pool will fail during serialization

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.