Trader Joe v2 contest - hxzy's results

Lines of code

https://github.com/code-423n4/2022-10-traderjoe/blob/main/src/LBToken.sol#L182-L192

Vulnerability details

Impact

When a user holds a certain number of tokens with a specified id, the user can double the number of tokens they hold by transferring money to themselves. Repeated transfers to themselves can achieve the effect of unlimited issuance of tokens with a specified id.

Proof of Concept

In the _transfer of the LBToken contract, if the from address and the to address are the same address, the execution result of line 191 will overwrite the execution result of the previous line of code. Affected code locations: https://github.com/code-423n4/2022-10-traderjoe/blob/main/src/LBToken.sol#L182-L192

For the convenience of testing, I set the _mint function property to public. First, mint 100 tokens with an id of 1 to yourself (as shown in 1 in the picture below), and then call safeTransferFrom to transfer all tokens to your own address (as shown in 2 in the picture below). Then call the balanceOf function to query the number of tokens with its own address id 1. You can see that it has become 200 (as shown in 3 in the picture below), but in fact the total number of tokens with id 1 is 100 ( as shown in 4 in the image linked below). https://drive.google.com/file/d/1TJyW9sGpYERyZBB7MdTD9kmIp4liwNni/view?usp=sharing

Tools Used

Remix, VS code

Recommended Mitigation Steps

It is recommended that safeTransferFrom cannot be called for token transfer when the from and to addresses are the same.