QuickSwap and StellaSwap contest - rvierdiiev's results

Lines of code

https://github.com/code-423n4/2022-09-quickswap/blob/main/src/core/contracts/AlgebraPool.sol#L193-L206

Vulnerability details

Impact

AlgebraPool.initialize is called to initialize pool with initial price.

It can be only called once, but it can be called by anyone.

Suppose that someone created new pool for USDT:USDC tokens by calling AlgebraFactory.createPool and wants to set price 1:1. Factory at this point has created new pool, but it is not initialized with initial price yet.

Now anyone can initialize that pair with any price by calling AlgebraPool.initialize. For example for USDT:USDC pair someone provided price 1:20. So as a result we have the pool initialized not in the way that creator wanted.

Proof of Concept

This test can be run in AlgebraPool.spec.ts file. It shows that after the pool is created, another account can initialize it with initial price.

it('initialized by anyone', async () => {
      const initPrice = encodePriceSqrt(1, 25)
      await pool.connect(other).initialize(initPrice)

      const { price, timepointIndex } = await pool.globalState()
      expect(price).to.eq(price)
      expect(timepointIndex).to.eq(0)
      expect((await pool.globalState()).tick).to.eq(-32191)
    })

Tools Used

Recommended Mitigation Steps

Let creator of the pool to provide initial price at the pool creating and call AlgebraPool.initialize inside AlgebraFactory.createPool.

1. Check address param for zero https://github.com/code-423n4/2022-09-quickswap/blob/main/src/core/contracts/AlgebraFactory.sol#L54-L55 https://github.com/code-423n4/2022-09-quickswap/blob/main/src/core/contracts/AlgebraFactory.sol#L77-L81 https://github.com/code-423n4/2022-09-quickswap/blob/main/src/core/contracts/AlgebraFactory.sol#L84-L88 https://github.com/code-423n4/2022-09-quickswap/blob/main/src/core/contracts/AlgebraFactory.sol#L91-L95

2. Add message to require statement. https://github.com/code-423n4/2022-09-quickswap/blob/main/src/core/contracts/AlgebraFactory.sol#L78 https://github.com/code-423n4/2022-09-quickswap/blob/main/src/core/contracts/AlgebraFactory.sol#L85 https://github.com/code-423n4/2022-09-quickswap/blob/main/src/core/contracts/AlgebraFactory.sol#L92 https://github.com/code-423n4/2022-09-quickswap/blob/main/src/core/contracts/DataStorageOperator.sol#L43 https://github.com/code-423n4/2022-09-quickswap/blob/main/src/core/contracts/libraries/DataStorage.sol#L369