Trader Joe contest - Jujic's results

One-stop-shop decentralized trading on Avalanche.

General Information

Platform: Code4rena

Start Date: 25/01/2022

Pot Size: $50,000 USDT

Total HM: 17

Participants: 39

Period: 3 days

Judge: LSDan

Total Solo HM: 9

Id: 79

League: ETH

Trader Joe

Findings Distribution

Researcher Performance

Rank: 9/39

Findings: 3

Award: $1,616.67

🌟 Selected for report: 2

🚀 Solo Findings: 1

External Links

Code4rena Contest Page Github Contest Repository Github Findings Repository Trader Joe

Findings Information

🌟 Selected for report: Jujic

Labels

bug

2 (Med Risk)

disagree with severity

sponsor confirmed

Awards

1556.9237 USDT - $1,556.92

External Links

Link to GitHub issue

Handle

Jujic

Vulnerability details

Impact

The rJoePerSec does not have any upper or lower bounds. Values that are too large will lead to reversions in several critical functions.

Proof of Concept

https://github.com/code-423n4/2022-01-trader-joe/blob/a1579f6453bc4bf9fb0db9c627beaa41135438ed/contracts/RocketJoeStaking.sol#L151

function updateEmissionRate(uint256 _rJoePerSec) external onlyOwner {
        updatePool();
        rJoePerSec = _rJoePerSec;
        emit UpdateEmissionRate(msg.sender, _rJoePerSec);
    }

Tools Used

Remix

Recommended Mitigation Steps

Consider define upper and lower bounds on the _rJoePerSec.

#0 - cryptofish7
2022-01-31T22:10:09Z

Confirming issue but disagree with severity.

Fix: https://github.com/traderjoe-xyz/rocket-joe/pull/112

Findings Information

🌟 Selected for report: cccz

Also found by: Czar102, Jujic, Meta0xNull, Ruhum, defsec, jayjonah8, kirk-baird, p4st13r4, pauliax, robee, wuwe1

Labels

bug

duplicate

1 (Low Risk)

Awards

13.5716 USDT - $13.57

External Links

Link to GitHub issue

Handle

Jujic

Vulnerability details

Impact

The functions initialize() can be called by anyone the first time, which allows an attacker to set the address rocketJoeFactory of the contract .

Proof of Concept

https://github.com/code-423n4/2022-01-trader-joe/blob/a1579f6453bc4bf9fb0db9c627beaa41135438ed/contracts/RocketJoeToken.sol#L25-L32

function initialize() external {
        require(
            address(rocketJoeFactory) == address(0),
            "RocketJoeToken: already initialized"
        );

        rocketJoeFactory = IRocketJoeFactory(msg.sender);
    }

Tools Used

Remix

Recommended Mitigation Steps

Add modifier

#0 - cryptofish7
2022-01-30T21:34:54Z

Duplicate of #68

#1 - dmvt
2022-02-22T10:44:08Z

Duplicate of #8

Findings Information

🌟 Selected for report: WatchPug

Also found by: 0x0x0x, Czar102, Dravee, Jujic, Meta0xNull, Ruhum, byterocket, defsec, gzeon, pedroais, robee, solgryn

Labels

bug

duplicate

G (Gas Optimization)

Awards

0.8642 USDT - $0.86

External Links

Link to GitHub issue

Handle

Jujic

Vulnerability details

Impact

!= 0 is a cheaper operation compared to > 0, when dealing with uint.

Proof of Concept

https://github.com/code-423n4/2022-01-trader-joe/blob/a1579f6453bc4bf9fb0db9c627beaa41135438ed/contracts/LaunchEvent.sol#L355

require(_amount > 0, "LaunchEvent: invalid withdraw amount");

Tools Used

Remix

Recommended Mitigation Steps

There are several other places throughout the codebase where the same optimization can be used.

#0 - cryptofish7
2022-01-31T14:05:59Z

Duplicate of #240

Findings Information

🌟 Selected for report: WatchPug

Also found by: Czar102, Dravee, Jujic, Meta0xNull, byterocket, defsec, p4st13r4, pauliax, robee, sirhashalot

Labels

bug

duplicate

G (Gas Optimization)

Awards

1.2609 USDT - $1.26

External Links

Link to GitHub issue

Handle

Jujic

Vulnerability details

Impact

Shortening revert strings to fit in 32 bytes will decrease deployment time gas and will decrease runtime gas when the revert condition has been met.

There are several other places throughout the codebase where the same optimization can be used.

Proof of Concept

https://github.com/code-423n4/2022-01-trader-joe/blob/a1579f6453bc4bf9fb0db9c627beaa41135438ed/contracts/RocketJoeToken.sol#L19

require(
            rocketJoeFactory.isRJLaunchEvent(msg.sender),
            "RocketJoeToken: caller is not a RJLaunchEvent"
        );

Tools Used

https://planetcalc.com/9029/

Recommended Mitigation Steps

Shorten the revert strings to fit in 32 bytes.

#0 - cryptofish7
2022-01-31T18:54:52Z

Duplicate of #242

Findings Information

🌟 Selected for report: WatchPug

Also found by: Dravee, Jujic, Rhynorater, TomFrenchBlockchain, defsec, hyh, ye0lde

Labels

bug

duplicate

G (Gas Optimization)

Awards

2.3783 USDT - $2.38

External Links

Link to GitHub issue

Handle

Jujic

Vulnerability details

Impact

For the arithmetic operations that will never over/underflow, using the unchecked directive (Solidity v0.8 has default overflow/underflow checks) can save some gas from the unnecessary internal over/underflow checks.

Proof of Concept

https://github.com/code-423n4/2022-01-trader-joe/blob/a1579f6453bc4bf9fb0db9c627beaa41135438ed/contracts/RocketJoeStaking.sol#L87

if (block.timestamp > lastRewardTimestamp && joeSupply != 0) {
            uint256 multiplier = block.timestamp - lastRewardTimestamp;

Tools Used

Remix

Recommended Mitigation Steps

Consider using 'unchecked' where it is safe to do so.

#0 - cryptofish7
2022-01-30T23:57:25Z

Duplicate of #233

Findings Information

🌟 Selected for report: hyh

Also found by: Czar102, Dravee, Jujic, bobi, byterocket, defsec, jayjonah8, p4st13r4

Labels

bug

duplicate

G (Gas Optimization)

Awards

1.9026 USDT - $1.90

External Links

Link to GitHub issue

Handle

Jujic

Vulnerability details

Impact

Using newer compiler versions and the optimizer gives gas optimizations and additional safety checks are available for free. The advantages of versions 0.8.* over <0.8.0 are: • Safemath by default from 0.8.0 (can be more gas efficient than library based safemath.) • Low level inliner : from 0.8.2, leads to cheaper runtime gas. Especially relevant when the contract has small functions. For example, OpenZeppelin libraries typically have a lot of small helper functions and if they are not inlined, they cost an additional 20 to 40 gas because of 2 extra jump instructions and additional stack operations needed for function calls. • Optimizer improvements in packed structs: Before 0.8.3, storing packed structs, in some cases used an additional storage read operation. After EIP-2929, if the slot was already cold, this means unnecessary stack operations and extra deploy time costs. However, if the slot was already warm, this means additional cost of 100 gas alongside the same unnecessary stack operations and extra deploy time costs. • Custom errors from 0.8.4, leads to cheaper deploy time cost and run time cost. Note: the run time cost is only relevant when the revert condition is met. In short, replace revert strings by custom errors.

Proof of Concept

pragma solidity ^0.8.0;

Tools Used

https://github.com/code-423n4/2021-10-mochi-findings/issues/34

Recommended Mitigation Steps

Consider to upgrade pragma to at least 0.8.4.

#0 - cryptofish7
2022-02-10T19:48:17Z

Duplicate of #181

Findings Information

🌟 Selected for report: WatchPug

Also found by: 0x0x0x, Czar102, Dravee, Jujic, Meta0xNull, Ruhum, byterocket, defsec, gzeon, pedroais, robee, solgryn

Labels

bug

duplicate

G (Gas Optimization)

Awards

0.8642 USDT - $0.86

External Links

Link to GitHub issue

Handle

Jujic

Vulnerability details

Impact

!= 0 is a cheaper operation compared to > 0, when dealing with uint.

Proof of Concept

https://github.com/code-423n4/2022-01-trader-joe/blob/a1579f6453bc4bf9fb0db9c627beaa41135438ed/contracts/LaunchEvent.sol#L355

require(_amount > 0, "LaunchEvent: invalid withdraw amount");

Tools Used

Remix

Recommended Mitigation Steps

There are several other places throughout the codebase where the same optimization can be used.

#0 - cryptofish7
2022-01-31T14:05:59Z

Duplicate of #240

Findings Information

🌟 Selected for report: WatchPug

Also found by: Czar102, Dravee, Jujic, Meta0xNull, byterocket, defsec, p4st13r4, pauliax, robee, sirhashalot

Labels

bug

duplicate

G (Gas Optimization)

Awards

1.2609 USDT - $1.26

External Links

Link to GitHub issue

Handle

Jujic

Vulnerability details

Impact

Shortening revert strings to fit in 32 bytes will decrease deployment time gas and will decrease runtime gas when the revert condition has been met.

There are several other places throughout the codebase where the same optimization can be used.

Proof of Concept

https://github.com/code-423n4/2022-01-trader-joe/blob/a1579f6453bc4bf9fb0db9c627beaa41135438ed/contracts/RocketJoeToken.sol#L19

require(
            rocketJoeFactory.isRJLaunchEvent(msg.sender),
            "RocketJoeToken: caller is not a RJLaunchEvent"
        );

Tools Used

https://planetcalc.com/9029/

Recommended Mitigation Steps

Shorten the revert strings to fit in 32 bytes.

#0 - cryptofish7
2022-01-31T18:54:52Z

Duplicate of #242

Findings Information

🌟 Selected for report: WatchPug

Also found by: Dravee, Jujic, Rhynorater, TomFrenchBlockchain, defsec, hyh, ye0lde

Labels

bug

duplicate

G (Gas Optimization)

Awards

2.3783 USDT - $2.38

External Links

Link to GitHub issue

Handle

Jujic

Vulnerability details

Impact

Proof of Concept

https://github.com/code-423n4/2022-01-trader-joe/blob/a1579f6453bc4bf9fb0db9c627beaa41135438ed/contracts/RocketJoeStaking.sol#L87

if (block.timestamp > lastRewardTimestamp && joeSupply != 0) {
            uint256 multiplier = block.timestamp - lastRewardTimestamp;

Tools Used

Remix

Recommended Mitigation Steps

Consider using 'unchecked' where it is safe to do so.

#0 - cryptofish7
2022-01-30T23:57:25Z

Duplicate of #233

Findings Information

🌟 Selected for report: hyh

Also found by: Czar102, Dravee, Jujic, bobi, byterocket, defsec, jayjonah8, p4st13r4

Labels

bug

duplicate

G (Gas Optimization)

Awards

1.9026 USDT - $1.90

External Links

Link to GitHub issue

Handle

Jujic

Vulnerability details

Impact

Proof of Concept

pragma solidity ^0.8.0;

Tools Used

https://github.com/code-423n4/2021-10-mochi-findings/issues/34

Recommended Mitigation Steps

Consider to upgrade pragma to at least 0.8.4.

#0 - cryptofish7
2022-02-10T19:48:17Z

Duplicate of #181

Trader Joe contest - Jujic's results

One-stop-shop decentralized trading on Avalanche.

General Information

Findings Distribution

Researcher Performance

External Links

🚀 [M-01] Improper Upper Bound Definition on the Fee - $1,556.92

Findings Information

Labels

Awards

External Links

Handle

Vulnerability details

Impact

Proof of Concept

Tools Used

Recommended Mitigation Steps

#0 - cryptofish72022-01-31T22:10:09Z

QA Report - $13.57

[L-14] Setting the `rocketJoeFactory` address in the ` initialize()` can be frontrun by an attacker - $13.57

Findings Information

Labels

Awards

External Links

Handle

Vulnerability details

Impact

Proof of Concept

Tools Used

Recommended Mitigation Steps

#0 - cryptofish72022-01-30T21:34:54Z

#1 - dmvt2022-02-22T10:44:08Z

Gas Report - $46.18

[G-02] > 0 can be replaced with != 0 for gas optimisation - $0.86

Findings Information

Labels

Awards

External Links

Handle

Vulnerability details

Impact

Proof of Concept

Tools Used

Recommended Mitigation Steps

#0 - cryptofish72022-01-31T14:05:59Z

[G-04] Long Revert Strings - $1.26

Findings Information

Labels

Awards

External Links

Handle

Vulnerability details

Impact

Proof of Concept

Tools Used

Recommended Mitigation Steps

#0 - cryptofish72022-01-31T18:54:52Z

[G-11] Adding unchecked directive can save gas - $2.38

Findings Information

Labels

Awards

External Links

Handle

Vulnerability details

Impact

Proof of Concept

Tools Used

Recommended Mitigation Steps

#0 - cryptofish72022-01-30T23:57:25Z

[G-64] Upgrade pragma to at least 0.8.4 - $1.90

Findings Information

Labels

Awards

External Links

Handle

Vulnerability details

Impact

Proof of Concept

Tools Used

Recommended Mitigation Steps

#0 - cryptofish7
2022-01-31T22:10:09Z

#0 - cryptofish7
2022-01-30T21:34:54Z

#1 - dmvt
2022-02-22T10:44:08Z

#0 - cryptofish7
2022-01-31T14:05:59Z

#0 - cryptofish7
2022-01-31T18:54:52Z

#0 - cryptofish7
2022-01-30T23:57:25Z

#0 - cryptofish7
2022-02-10T19:48:17Z

#0 - cryptofish7
2022-01-31T14:05:59Z

#0 - cryptofish7
2022-01-31T18:54:52Z

#0 - cryptofish7
2022-01-30T23:57:25Z

#0 - cryptofish7
2022-02-10T19:48:17Z