Trader Joe v2 contest - saian's results

Lines of code

https://github.com/code-423n4/2022-10-traderjoe/blob/79f25d48b907f9d0379dd803fc2abc9c5f57db93/src/LBToken.sol#L176

Vulnerability details

Impact

In LBToken._transfer() balances of _from and _to are stored in temporary variables and after the subtration, addition operation the results are written to storage. In the second operation since the original balance is used in the addition operation, if from == to the address will have extra tokens in the balance. So a user can self transfer tokens for id, burn and transfer more than supplied assets from a pair contract

Proof of Concept

function _transfer(
	address _from,
	address _to,
	uint256 _id,
	uint256 _amount
) internal virtual {
	uint256 _fromBalance = _balances[_id][_from];
	if (_fromBalance < _amount) revert LBToken__TransferExceedsBalance(_from, _id, _amount);
	
	_beforeTokenTransfer(_from, _to, _id, _amount);
	
	uint256 _toBalance = _balances[_id][_to];
	
	unchecked {
		_balances[_id][_from] = _fromBalance - _amount;
		_balances[_id][_to] = _toBalance + _amount; // @audit 
	}
	
	_remove(_from, _id, _fromBalance, _amount); // @audit from==to
	_add(_to, _id, _toBalance, _amount);
}

Tools Used

Manual analysis

Recommended Mitigation Steps

Add condition to prevent transfer between same addresses