Trader Joe contest - ye0lde's results

Handle

ye0lde

Vulnerability details

Impact

Save Gas With The Unchecked Keyword (LaunchEvent.sol)

Redundant arithmetic underflow/overflow checks can be avoided when an underflow/overflow cannot happen.

Proof of Concept

The "unchecked" keyword can be applied here since there is an "if" statement to ensure the arithmetic operations would not cause an integer underflow or overflow. https://github.com/code-423n4/2022-01-trader-joe/blob/a1579f6453bc4bf9fb0db9c627beaa41135438ed/contracts/LaunchEvent.sol#L327-L333

Change the code at 327 to:

         unchecked {
            if (newAllocation > user.allocation) {  
                // Burn tokens and update allocation.
                rJoeNeeded = getRJoeAmount(newAllocation - user.allocation);
                // Set allocation to the current balance as it's impossible
                // to buy more allocation without sending AVAX too
                user.allocation = newAllocation;
            }
        }

A similar change can be made here around line 361: https://github.com/code-423n4/2022-01-trader-joe/blob/a1579f6453bc4bf9fb0db9c627beaa41135438ed/contracts/LaunchEvent.sol#L361

Tools Used

Visual Studio Code, Remix

Recommended Mitigation Steps

Add the "unchecked" keyword as shown above.