Trader Joe contest - hack3r-0m's results

Handle

hack3r-0m

Vulnerability details

https://github.com/code-423n4/2022-01-trader-joe/blob/main/contracts/LaunchEvent.sol#L4905

while withdrawing incentives, the contract does not check if erc20 transfer was successful or not, if due to minor rounding error (at 17th/18th decimal place, which is possible) and the contract does not have enough token to make the transfer and hence false is returned which is ignored.

So the user is marked claimed however transfer has failed.

Manual Review

Recommended Mitigation Steps

Use SafeTransfer or TransferHelper

Handle

hack3r-0m

Vulnerability details

https://github.com/code-423n4/2022-01-trader-joe/blob/main/contracts/RocketJoeFactory.sol#L133

createRJLaunchEvent is followed by initialization of launch event, the balance of launch event address is what is supplied by above mentioned safe transfer call

According to EIP20, transferFrom returns boolean

function transferFrom(address _from, address _to, uint256 _value) public returns (bool success)

If it returns false, value is not checked and execution continues, this results in the creation of the launch event successfully.

And it is harmful because the same factory cannot ever create launch event for same token again.

Tools Used

Manual Review

Recommended Mitigation Steps

Use SafeTransfer or TransferHelper