Trader Joe contest - static's results

Handle

static

Vulnerability details

Impact

If the owner of the contract set (specifically the Factory owner), executes allowEmergencyWithdraw after the pair is created, then the withdraw functions including the emergencyWithdraw will not function and the funds (including the liquidity tokens), will be stuck in the contract.

Proof of Concept

N/A

Tools Used

N/A

Recommended Mitigation Steps

There are a few possible solutions, you could technically do any of the following:

• Don't allow locking the contract when the pair has already been created or remove the isStopped modifier from the pair-related withdraw functions.
• Implement a new emergency withdraw (or re-work the current function) to allow withdrawing the liquidity tokens from the contract in the event it is locked.
• Allow unlocking the contract when the pair has been created.

Handle

static

Vulnerability details

Impact

The deposit function performs a check followed by an interaction, then the effect. If for some reason the rJOE token is altered to possess callbacks that go to untrusted contracts, then a user could call deposit multiple times using re-entrancy to extract extra rewards and drain the contract.

However, because the rJOE token is a standard ERC20 without callbacks, this issue has been marked as low severity.

Proof of Concept

N/A

Tools Used

N/A

Recommended Mitigation Steps

Follow the check-effect-interaction pattern by moving the _safeRJoeTransfer function to be after the lines setting user.amount and user.rewardDebt.