Submitted by broccolirob
If a borrower calls the createPool function with a non-zero value, but also includes an ERC20 token address for _collateralToken, then the Ether value sent will be locked in the PoolFactory contract forever.
In the _createPool function, a _collateralToken address other than the zero address will set the amount variable to zero. That amount variable will be passed to create2 which will send 0 wei to the newly created Pool contract.
A borrower can accidentally lock Ether in the PoolFactory without the ability to retrieve it.
A borrower reuses a script they made to create a pool and deposit collateral. They intend to deposit Ether as collateral so they send value with the transaction, but forget to change the _collateralToken address to address(0). The Pool contract will be deployed using the _collateralToken, and will lock the Ether sent in the PoolFactory
Manual analysis and Hardhat.
If msg.value is greater than 0, make sure the _collateralToken address is set to address(0).
ritik99 (Sublime) disputed and disagreed with severity:
0xean (judge) commented:
