Description

Normally, only a trusted minter whose address is in the MinterMap is allowed to call Create to create new tokens. However, in the function implementation, this is only checked if the owner is set:

public override Empty Create(CreateInput input)
{
    if (State.Owner.Value != null)
    {
        AssertSenderIsMinter();
    }

    // [...]
}

This means that if the contract is deployed but not initialized, this check is skipped, and anyone can create tokens with any name.

Impact

Quick users can create tokens with symbols that the swap contract would create as LP tokens by sniping them during the deployment process. If they succeed, they will control the token instead of the swap contract.

Recommendations

Remove the conditional and always check AssertSenderIsMinter. This check will always return false if the contract is uninitialized, since the MinterMap is empty before initialization.

Remediation

This issue has been acknowledged by Awaken Finance, and a fix was implemented in commit 1eeef4bf↗.