Trader Joe v2 contest - JMukesh's results

Lines of code

https://github.com/code-423n4/2022-10-traderjoe/blob/79f25d48b907f9d0379dd803fc2abc9c5f57db93/src/LBToken.sol#L176

Vulnerability details

Impact

Due to lack of check for the sender and recipient address , self transfer can increase the balance

Proof of Concept

function _transfer(
        address _from,
        address _to,
        uint256 _id,
        uint256 _amount
    ) internal virtual {
        uint256 _fromBalance = _balances[_id][_from];
        if (_fromBalance < _amount) revert LBToken__TransferExceedsBalance(_from, _id, _amount);

        _beforeTokenTransfer(_from, _to, _id, _amount);

        uint256 _toBalance = _balances[_id][_to];

        unchecked {
            _balances[_id][_from] = _fromBalance - _amount;
            _balances[_id][_to] = _toBalance + _amount;
        }

        _remove(_from, _id, _fromBalance, _amount);
        _add(_to, _id, _toBalance, _amount);
    }

it record the balance of sender and recceiver before updating the balance due to which if the address of both sender and receiver are same it will increase the balance

ex:- let say alice has 100 tokens initially want to transfer 10 tokens, now when she call safeTransferFrom() or SafeBatchTransferFrom().

First these fucntion will check for the validity address through "checkaddress()" and then check for the approval. In the checkApproval() spender can be equal to Owner this check will also be passed.

In _transfer() ,

FromBalance = 100 toBalance = 100

unchecked { _balances[_id][Alice] = 100- 10; _balances[_id][Alice] = 100+ 10; }

total balance of [Alice] = 110

Tools Used

manual review

Recommended Mitigation Steps

add the checks for checking recipient and sender address are not same