Trader Joe v2 contest - sorrynotsorry's results

Judge has assessed an item in Issue #474 as M risk. The relevant finding follows:

[L-01] Flashloan fee is not validated _flashLoanFee is determined at LBFactory's constructor as;

constructor(address _feeRecipient, uint256 _flashLoanFee) {
    _setFeeRecipient(_feeRecipient);


    flashLoanFee = _flashLoanFee;
    emit FlashLoanFeeSet(0, _flashLoanFee);
}

Permalink

and in setFlashLoanFee() as;

function setFlashLoanFee(uint256 _flashLoanFee) external override onlyOwner {
    uint256 _oldFlashLoanFee = flashLoanFee;


    if (_oldFlashLoanFee == _flashLoanFee) revert LBFactory__SameFlashLoanFee(_flashLoanFee);


    flashLoanFee = _flashLoanFee;
    emit FlashLoanFeeSet(_oldFlashLoanFee, _flashLoanFee);
}

Permalink

However, if the the fee somehow is set to an arbitrary ratio such as 100% (even the intention is to set the fee to 10%), this will lead to flashloan causing loss of funds for the user who uses it. It would be the best if the flashloan fee is required to be in boundries which is set by the protocol.