# Pool takeover validation gap

Takeover/re-init functions that skip bounds on zeroable or directional params feeding later math

_Area: Smart contract access control and control flow. Seen in 2 disclosed reports; latest 2024-03-10. Updated 2026-10-23._

## How it works
A pool takeover or re-initialization path accepts caller-supplied parameters and uses them in downstream calculations, but validates only some of them. The unchecked parameter can be zeroed or pushed to an extreme, which changes derived values (token amounts, virtual balances) so the caller clears the intended bar cheaply, or makes the path always revert. The broken assumption is that "the other checks cover it" — they don't, because the unchecked value feeds the same math.

## Where it shows up
- Takeover/re-init functions that read a struct of init params but only assert on one field.
- Parameters used in multiplication or division that can be zero or near type limits.
- Docstrings stating a directional rule ("can lower, not raise") with no matching comparison in code.
- Factory `createPair`/constructor accepting numeric config that later feeds `uint112*uint112*uint112`-style products.
- Penalty or minimum-increase checks computed from a value the caller controls.

## How to review
For every takeover/re-init entry point, list each caller-supplied parameter and trace it to every use. The invariant: every parameter that influences a threshold, derived amount, or arithmetic result must be independently bounded (non-zero where required, within a safe range, and respecting any documented direction) before use. Confirm the bound is on the same variable the math consumes, not a proxy. For factory config, check that max values of each operand times the others cannot overflow the result type.

## Variants seen
- Zeroed `initialEth` inflates computed token amounts, bypassing the minimum token check [E1](https://bugbountylibrary.com/r/sherlock%3A2024-03-goat-trading%3AM-2.md).
- Missing virtual-Ether directional check lets a legitimate pool be taken over cheaply while the original LP pays the penalty [E2](https://bugbountylibrary.com/r/sherlock%3A2024-03-goat-trading%3AM-3.md).
- Extreme initial params cause overflow in `takeOverPool`, permanently locking a pair [E3](https://bugbountylibrary.com/r/sherlock%3A2024-03-goat-trading%3AM-5.md).

## Impact and severity
Cheap seizure of live pools, unfair penalty to original LPs, and permanent denial of service via un-takeoverable pairs. Severity rises when the pool holds real liquidity and when the flaw is reachable by any caller with no cost.

## Why fixes fail
Validating one parameter (token amount) while leaving a sibling parameter (initialEth, virtualEth) unchecked leaves the derived-value manipulation open [E1](https://bugbountylibrary.com/r/sherlock%3A2024-03-goat-trading%3AM-2.md)[E2](https://bugbountylibrary.com/r/sherlock%3A2024-03-goat-trading%3AM-3.md).

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-03-goat-trading%3AM-2.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-03-goat-trading%3AM-3.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-03-goat-trading%3AM-5.md