V3factory will fail to initialize because of a wrong check

[howlbot-integration]

Lines of code

https://github.com/ronin-chain/katana-v3-contracts/blob/03c80179e04f40d96f06c451ea494bb18f2a58fc/src/core/KatanaV3Pool.sol#L122
https://github.com/ronin-chain/katana-v3-contracts/blob/03c80179e04f40d96f06c451ea494bb18f2a58fc/src/core/KatanaV3Pool.sol#L112-L113

Vulnerability details

Proof of Concept

The initialize function in the v3Katanapool contract has a misconfiguration that causes it to revert unexpectedly, preventing initialization of the pool parameters. Here’s an analysis of the code and impact:

1. Issue: When the initialize function is called, it checks if factory is address(0) rather than address(1). This check fails each time because the constructor sets factory to address(1), causing the initialize function to revert and halt the pool setup.

2. Code Reference:

   • Constructor:

    constructor() {

        // Disable immutables initialization
@audit>>         factory = address(1);

    }

• Initialize Function:

    function initializeImmutables(address factory_, address token0_, address token1_, uint24 fee_, int24 tickSpacing_)
        public
        virtual
        override
    {

@audit>>          require(factory == address(0), "AII");
        // Other initialization code

    }

3. Impact: This bug blocks the contract from setting key parameters and utilizing v3Pool, effectively making the system unusable until corrected.

Recommended Mitigation Steps

To fix this issue:

• Solution: Modify the initialize function's check to ensure factory is set to address(1) instead of address(0).

• Code Update:

  function initializeImmutables(address factory_, address token0_, address token1_, uint24 fee_, int24 tickSpacing_)
      public
      virtual
      override
  {
      require(factory == address(1), "AII");  // Corrected check
      // Additional initialization code
  }

Assessed type

DoS

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Invalid