QuickSwap and StellaSwap contest - ch13fd357r0y3r's results

Lines of code

https://github.com/code-423n4/2022-09-quickswap/blob/15ea643c85ed936a92d2676a7aabf739b210af39/src/core/contracts/AlgebraPoolDeployer.sol#L44 https://github.com/code-423n4/2022-09-quickswap/blob/15ea643c85ed936a92d2676a7aabf739b210af39/src/core/contracts/AlgebraPool.sol#L193

Vulnerability details

When The Algebra deployer deploys the new Pool, It does not initialize the function initialize() to set the Price and tick value. This forms an attack vector where an attacker can initialize the price with an arbitrary amount when a new Pool is deployed.

Impact

Anyone can initialize the price and initialize the DataStorageOperator with tick value

Proof of Concept

1. AlgebraDeployer Deploys a new Pool.
2. Attacker Watches for new Deployment of Pool Contract in mempool.
3. After Successful Deployment, the Attacker initializes the initialize() function with his preferred price.

Tools Used

Manual Analysis

Recommended Mitigation Steps

Initialize it in the deployer contract

pool.intialize(PRICE);