PanopticFactory#deployNewPool()
can be called by anyone if initialize()
was front-run.
#153
Labels
bug
Something isn't working
downgraded by judge
Judge downgraded the risk level of this issue
duplicate-523
edited-by-warden
grade-c
QA (Quality Assurance)
Assets are not at risk. State handling, function incorrect as to spec, issues with clarity, syntax
🤖_16_group
AI based duplicate group recommendation
Lines of code
https://github.com/code-423n4/2024-04-panoptic/blob/main/contracts/PanopticFactory.sol#L134-L139
https://github.com/code-423n4/2024-04-panoptic/blob/main/contracts/PanopticFactory.sol#L210-L276
Vulnerability details
Description
initialize()
can be called with any_owner
value even if it is zero value.s_owner
can't be changed with Panoptic#transferOwnership()
s_owner
was initialized with some invalid value first.initialize()
transaction with his address.s_owner
was assigned to zero address,deployNewPool()
is skipped (L224) and so PanopticFactory#deployNewPool()
can be called anyone.deployNewPool()
with the all availabletoken0
,token1
,fee
pairs.Impact
s_owner
was initialized with invalid value, the ownership of PanopticFactory can't be transferred.s_owner
was assigned to zero addres and PanopticFactory#deployNewPool()
was called with the all availabletoken0
,token1
,fee
pairs by attacker, the normal user can't deploy new pool any more.Proof of Concept
Bob
, front runs the normal owner,Alice
, 's Panoptic#initialize()
transaction with zero address.Bob
' calls PanopticFactory#deployNewPool()
with the all availabletoken0
,token1
,fee
pairs andsalt
same as his address.Alice
can't transfer ownership of factory with Panoptic#transferOwnership()
.Alice
can't deploy new pool sinceBob
already filleds_getPanopticPool
mapping variable with all available value.Tools Used
Manual Review
Recommended Mitigation Steps
constructor
for initializings_owner
instead of using PanopticFactory#initialize()
.deployNewPool()
as following.Assessed type
Invalid Validation
The text was updated successfully, but these errors were encountered: