A malicious user could intentionally exhaust storage by creating unlimited positions without requiring any initial liquidity. This issue exists in the position minting functionality where users are allowed to create new positions by only specifying tick ranges without being required to provide any liquidity.
In lib.rs, the position minting function only validates basic parameters:
The pools create_position function in pool.rs only validates tick spacing:
The position creation in position.rs simply stores empty position data:
Attackers can create unlimited positions with zero liquidity. Each position consumes permanent storage space in the StorageMap<U256, StoragePositionInfo>.
A malicious user could:
Consider implementing atomic position creation:
Also, consider implementing a minimum liquidity threshold that must be provided during position creation, because we need to prevent zero-liquidity position spam while allowing legitimate small positions.
