Platform: Code4rena
Start Date: 25/01/2022
Pot Size: $50,000 USDT
Total HM: 17
Participants: 39
Period: 3 days
Judge: LSDan
Total Solo HM: 9
Id: 79
League: ETH
Rank: 21/39
Findings: 2
Award: $679.91
🌟 Selected for report: 1
🚀 Solo Findings: 0
wuwe1
There is no access control on initialize
https://github.com/code-423n4/2022-01-trader-joe/blob/main/contracts/RocketJoeToken.sol#L25
Malicious actor might front-run the deployer and call initialize in RocketJoeFactory . This griefing attack would prevent RocketJoeFactory from deploying.
https://github.com/code-423n4/2022-01-trader-joe/blob/main/contracts/RocketJoeFactory.sol#L62
setRJoe is affected by this too.
https://github.com/code-423n4/2022-01-trader-joe/blob/main/contracts/RocketJoeFactory.sol#L160
Add access control on initialize
#0 - cryptofish7
2022-01-30T21:20:28Z
Duplicate of #155 and #8
#1 - dmvt
2022-02-22T10:41:51Z
Assets are not at risk. The worst case is that there is lost gas and the contracts need to be redeployed. Consider creating these contracts and calling their initialize functions in a factory to mitigate the issue if not adding the guard.
1 — Low (L): vulns that have a risk of 1 are considered “Low” severity when assets are not at risk. Includes state handling, function incorrect as to spec, and issues with comments.
🌟 Selected for report: WatchPug
Also found by: Dravee, TomFrenchBlockchain, wuwe1
wuwe1
LaunchEvent does not use any function in Ownable.
https://github.com/code-423n4/2022-01-trader-joe/blob/main/contracts/LaunchEvent.sol#L19
Remove Ownable in LaunchEvent
#0 - cryptofish7
2022-01-31T11:16:23Z
Duplicate of #241
wuwe1
If parameter get wrong, it might need to be redeployed.
RocketJoeStaking.sol
_joe could be 0
_rJoe could be 0
https://github.com/code-423n4/2022-01-trader-joe/blob/main/contracts/RocketJoeStaking.sol#L72-L73
Add zero value check on this variable.
#0 - cryptofish7
2022-01-30T23:41:04Z
Duplicate of #266
🌟 Selected for report: wuwe1
518.9746 USDT - $518.97
wuwe1
Causing confuse to user and developer.
https://github.com/code-423n4/2022-01-trader-joe/blob/main/contracts/LaunchEvent.sol#L55
105000 * 1e18 / (1e18 + 5e16) is equal to 100000
change to
105000 - 105000 * 1e18 / (1e18 + 5e16) = 5000
#0 - cryptofish7
2022-01-31T23:14:21Z
#1 - dmvt
2022-02-23T12:55:29Z
Equation in comment is technically incorrect and results in confusion. Low risk is reasonable in this case.