Trader Joe v2 contest - chaduke's results

Judge has assessed an item in Issue #75 as M risk. The relevant finding follows:

Line 237, _beforeTokenTransfer(address(0), _account, _id, _amount); should be beforeTokenTransfer(account, address(0), _id, _amount);

Lines of code

https://github.com/code-423n4/2022-10-traderjoe/blob/79f25d48b907f9d0379dd803fc2abc9c5f57db93/src/LBFactory.sol#L474

Vulnerability details

Impact

Detailed description of the impact of this finding. The LBFactory contract allows the owner to set a new flashLoanFee via the setFalthLoanFee function, and leaves much power for the owner. If the owner, being it a user or a contract, the consequence to flash loan might be huge.

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. https://github.com/code-423n4/2022-10-traderjoe/blob/79f25d48b907f9d0379dd803fc2abc9c5f57db93/src/LBFactory.sol#L474

Tools Used

Remix

Recommended Mitigation Steps

Introduce a if-revert check to ensure that the new _flashLoanFee is within a range. In addition, include the owner information in the emit statement to improve accountability since the owner might be changing.