Trader Joe contest - Funen's results

Handle

Funen

Vulnerability details

Impact

The user's that had been deploy the contract will got zero address

Proof of Concept

https://github.com/code-423n4/2022-01-trader-joe/blob/main/contracts/RocketJoeFactory.sol#L53-L61 This contract was using address to check that Addresses can't be zero address

E.g. : https://github.com/code-423n4/2022-01-trader-joe/blob/main/contracts/RocketJoeStaking.sol this wasnt check that addresses not zero address

Tools Used

Manual Review

Handle

Funen

Vulnerability details

Proof of Concept

https://github.com/code-423n4/2022-01-trader-joe/blob/main/contracts/LaunchEvent.sol#L48-L50 the Phase called from RJoeFactory.sol , so immutable can saving more gas

Tools Used

Manual Review

Recommended Mitigation Steps

uint256 public PHASE_ONE_DURATION ;  
uint256 public PHASE_ONE_NO_FEE_DURATION; 
uint256 public PHASE_TWO_DURATION;

changed into

uint256 public immutable PHASE_ONE_DURATION; 
uint256 public immutable PHASE_ONE_NO_FEE_DURATION; 
uint256 public immutable PHASE_TWO_DURATION; 

Handle

Funen

Vulnerability details

RocketJoeStaking.sol in https://github.com/code-423n4/2022-01-trader-joe/blob/main/contracts/RocketJoeStaking.sol#L24 comment was using -> // pending reward = (user.amount * accRJoePerShare) - user.rewardDebt

it should be used PRECISION to make it same actual calculation in the contract

and change to

pending reward = (user.amount * _accRJoePerShare) / PRECISION - user.rewardDebt