Different position input of token0 and token1 , will result in different pool Id

[c4-bot-9]

Lines of code

https://github.com/code-423n4/2023-11-panoptic/blob/main/contracts/libraries/PanopticMath.sol#L48-L59

Vulnerability details

Impact

if change positions of token0 and token1 when calling getFinalPoolId， according the keccak256 function , will result same token pair to different pool id

Proof of Concept

    function getFinalPoolId(
        uint64 basePoolId,
        address token0,
        address token1,
        uint24 fee
    ) internal pure returns (uint64) {
        unchecked {
            return
                basePoolId +
                (uint64(uint256(keccak256(abi.encodePacked(token0, token1, fee)))) >> 32);
        }
    }

if we change token0 -> token1 and token1 -> token0, the pood id will be different .

Tools Used

Vscode

Recommended Mitigation Steps

use token address sort method

if (tokenA > tokenB) (tokenA, tokenB) = (tokenB, tokenA);

Assessed type

Library

[c4-judge]

Picodes marked the issue as primary issue

[c4-sponsor]

dyedm1 (sponsor) disputed

[dyedm1]

This is true, but not an issue. At this point, the poolId is different than what can be computed from the address anyway, so you would have to call the getpoolid function regardless of the order the tokens are specified. It doesn't really matter whether the hash we use to differentiate the pools is calculated with one order of tokens or another - it actually makes it harder to make an undeployable pool since we have two different hash options.

[c4-judge]

Picodes changed the severity to QA (Quality Assurance)

[c4-judge]

Picodes marked the issue as grade-b