An attacker can frontrun the initialize() function in AlgebraPool.sol to set an unexpected price and can cause loss of funds for the initial LP deposit.
An user creates a pool for tokenA and tokenB, e.g. USDC:DAI.
An attacker frontruns the AlgebraPool.initialize() function and set a incorrect price for the pool.
The original user deposits the tokens.
The attacker swaps the tokens at an incorrect price, at the expense of the original user and causing loss of funds.
Recommended Mitigation Steps
Ensure initialize() has access control - can only be called by the owner or by trusted addresses - e.g. by quickswap frontends or verified external addresses.
Another alternative would be to run initialize in the constructor since it should only be initialized once.
Lines of code
https://github.com/code-423n4/2022-09-quickswap/blob/main/src/core/contracts/AlgebraPool.sol#L193-L206
Vulnerability details
Impact
An attacker can frontrun the
initialize()
function inAlgebraPool.sol
to set an unexpected price and can cause loss of funds for the initial LP deposit.Proof of Concept
https://github.com/code-423n4/2022-09-quickswap/blob/main/src/core/contracts/AlgebraPool.sol#L193-L206
AlgebraPool.initialize()
function and set a incorrect price for the pool.Recommended Mitigation Steps
Ensure
initialize()
has access control - can only be called by the owner or by trusted addresses - e.g. by quickswap frontends or verified external addresses.Another alternative would be to run initialize in the constructor since it should only be initialized once.