Platform: Code4rena
Start Date: 25/01/2022
Pot Size: $50,000 USDT
Total HM: 17
Participants: 39
Period: 3 days
Judge: LSDan
Total Solo HM: 9
Id: 79
League: ETH
Rank: 29/39
Findings: 2
Award: $132.15
🌟 Selected for report: 1
🚀 Solo Findings: 0
Tomio
in the https://github.com/code-423n4/2022-01-trader-joe/blob/main/contracts/RocketJoeFactory.sol#L98 the user can create launchevent, and providing _token to the launchevent contract, however, some token may behave differently when handling a failed transfer and transferFrom, some token may handle failed transfer and transferFrom by returning a false condition rather than reverting the transaction, in this line https://github.com/code-423n4/2022-01-trader-joe/blob/main/contracts/RocketJoeFactory.sol#L133 the return value is ignored, even though the transferFrom might handle failed transferFrom differently by returning a false. to fix this issue use SafeERC20, because not only does this contract handle the false return value, but also handles a token that was didn't comply with erc20.
https://github.com/code-423n4/2022-01-trader-joe/blob/main/contracts/RocketJoeFactory.sol#L133
Manual review
#0 - cryptofish7
2022-01-31T00:42:05Z
Duplicate of #232
#1 - dmvt
2022-02-22T19:25:54Z
duplicate of #198
17.9007 USDT - $17.90
Tomio
if the value is 0, will waste gas to transfer 0 value
https://github.com/code-423n4/2022-01-trader-joe/blob/main/contracts/RocketJoeStaking.sol#L125
Remix
function withdraw(uint256 _amount) external { UserInfo storage user = userInfo[msg.sender]; require( user.amount >= _amount, "RocketJoeStaking: withdraw amount exceeds balance" ); updatePool(); uint256 pending = (user.amount * accRJoePerShare) / PRECISION - user.rewardDebt; if(pending > 0){ _safeRJoeTransfer(msg.sender, pending); } user.amount = user.amount - _amount; user.rewardDebt = (user.amount * accRJoePerShare) / PRECISION; joe.safeTransfer(address(msg.sender), _amount); emit Withdraw(msg.sender, _amount);
#0 - cryptofish7
2022-01-31T00:02:43Z
Duplicate of #71
🌟 Selected for report: Tomio
39.7792 USDT - $39.78
Tomio
Expensive gas
https://github.com/code-423n4/2022-01-trader-joe/blob/main/contracts/LaunchEvent.sol#L574
Remix
add unchecked to save gas
function getRJoeAmount(uint256 _avaxAmount) public view returns (uint256) { unchecked{ return _avaxAmount * rJoePerAvax; } }