QuickSwap and StellaSwap contest - s3cunda's results

Lines of code

https://github.com/code-423n4/2022-09-quickswap/blob/main/src/core/contracts/AlgebraPool.sol#L193-L206 https://github.com/code-423n4/2022-09-quickswap/blob/main/src/core/contracts/AlgebraFactory.sol#L58-L74 https://github.com/code-423n4/2022-09-quickswap/blob/main/src/core/contracts/AlgebraPoolDeployer.sol#L43-L53

Vulnerability details

Impact

hackers can set the initial price to an arbitrary number, which can cause the insolvency of the protocol.

Proof of Concept

there is no function AlgebraPool.initialize invocation during the full creation process of AlgebraPool, which means the deployment and initialize are two separate step, and the initialize function has no restriction of the caller, so theorically anyone can call this function once they know the pool address. review the creation process of the pool in factory and deployer contract, you're using new method to create the pool contract, and new method is in fact using create2 in evm, so the address is predictable, so the above mentioned exploitation is totaly feasible. so the step is: hacker monitoring the mempool, fetch the creation of the pool, and then backrun this txn or front run the initialize function call txn, set the price into a very unreasonable number.

Tools Used

Recommended Mitigation Steps

combine the creation and initialize step into one,