When pool has zero liquidity, its price can be manipulated through calling `RamsesV3Pool.swap` function and possibly further minting single-sided liquidity
Audit: 2024-10-ramses-exchange-findings
Severity: MEDIUM

# Lines of code

https://github.com/code-423n4/2024-10-ramses-exchange/blob/5690cae9ed88e3e62256e703fd5012f8b0c8dcac/contracts/CL/core/RamsesV3Pool.sol#L420-L681


# Vulnerability details

## Impact
When a pool has zero liquidity, calling the `RamsesV3Pool.swap` function can manipulate the pool's price to an arbitrary price, which is different than the pool's initial price, without actually sending any tokens to the pool. Afterwards, the attacker can also mint single-sided liquidity to complicate the process of swapping the pool's price back to its initial price.

This can be problematic in which an attacker can frontrun a legitimate `RamsesV3Pool.mint` transaction by manipulating the pool's price through calling the `RamsesV3Pool.swap` function when the pool has zero liquidity. After such frontrunning, the minter can mint at a worse price. If such `RamsesV3Pool.mint` transaction is protected by a slippage control, it can revert since the expected token amounts to be added to the pool are not met but this DOS can be repeated each time a `RamsesV3Pool.mint` transaction is initiated; otherwise, the attacker can perform another swap after such `RamsesV3Pool.mint` transaction and makes profit from the unfair price.

Moreover, this can disrupt fundraising projects that want to utilize the `RamsesV3Pool`. Such projects can offer a new token to raise another token and add the offered and raised tokens to a pool for earning fees and trading when the price of the pool is the target initial price. During the fundraising period, the pool can be initialized with the target price but the price of such pool that has zero liquidity can be manipulated by an attacker through calling the `RamsesV3Pool.swap` function. Although these projects can also call the `RamsesV3Pool.swap` function to swap back and reset the pool's price to its target initial price without sending any tokens to the pool, the attacker can mint single-sided liquidity after his `RamsesV3Pool.swap` function call to add only the token to be raised to the pool and set the pool's price to be different than the target price. After such single-sided liquidity is added, the projects must perform actual swaps to add the offered token to the pool to bring the pool's price back to its target initial price. If the projects hold insufficient offered token in their own accounts for performing such swaps, the pool's price cannot be changed back to its target initial price. Moreover, it is also possible that all of the offered token are owned by a contract for fundraising purpose in which such contract can add the offered and raised tokens to the pool but cannot perform any swaps; in this case, the pool's price can never be changed back to its target initial price either. Thus, such fundraising projects that want to integrate with the `RamsesV3Pool` are disrupted.

## Proof of Concept
To run the following tests, https://github.com/code-423n4/2024-10-ramses-exchange/blob/5690cae9ed88e3e62256e703fd5012f8b0c8dcac