Submitted by DadeKuma, also found by sammy, Dup1337, Bauchibred, jesjupyter, and Vancelot
When deployNewPool is called it uses the spot price of the pool, which can be manipulated through a flashloan and thus could return a highly inaccurate result.
The price is used when deciding how much liquidity should be minted for each token, so this can result in an unbalanced pool.
In other parts of the code, this is not an issue as there are oracles that prevent price manipulations, but in case there arent any checks to avoid so.
The spot price is used to calculate the range liquidity for each token:
https://github.com/code-423n4/2024-04-panoptic/blob/833312ebd600665b577fbd9c03ffa0daf250ed24/contracts/PanopticFactory.sol#L341-L374
But unlike other parts of the code, the PanopticFactory doesnt have any checks against the price (it doesnt use any oracles nor the TWAP), so each token liquidity is manipulable through flash loans.
Consider using the TWAP price instead of the spot price.
Uniswap
dyedm1 (Panoptic) disputed and commented:
Picodes (judge) commented:
Picodes (judge) decreased severity to Medium and commented:
dyedm1 (Panoptic) commented:
