code-423n4/2022-01-trader-joe-findings

Issues

• Code does not follow the best practice of check-effects-interaction

  #321 opened 2 years ago by marchev
  0

• Lack of input checks (withrawal penalties should always be greater than 0)

  #314 opened 4 years ago by code423n4
  2

• Timelock could be set to 0

  #316 opened 4 years ago by code423n4
  2

• user can withdraw avax without paying penalty fees

  #312 opened 4 years ago by code423n4
  3

• Anyone can call deposit or withdraw with zero amount (LaunchEvent.sol)

  #317 opened 4 years ago by code423n4
  2

• Variables could be inmutable

  #311 opened 4 years ago by code423n4
  1

• less gas used `_owner` instead of call function `owner()`

  #281 opened 4 years ago by code423n4
  2

• PRECISION is constant

  #301 opened 4 years ago by code423n4
  2

• Gas Optimization: Variables that could be set constant

  #293 opened 4 years ago by code423n4
  2

• Mark constant variables constant

  #275 opened 4 years ago by code423n4
  2

• transferFrom can return false, and didnt revert

  #287 opened 4 years ago by code423n4
  2

• Unsafe ERC20 Operation(s)

  #272 opened 4 years ago by code423n4
  2

• transferFrom return value unchecked

  #315 opened 4 years ago by code423n4
  2

• Unspecific Compiler Version Pragma

  #273 opened 4 years ago by code423n4
  2

• Remove unused variable

  #286 opened 4 years ago by code423n4
  2

• Event for withdraws is never emitted

  #313 opened 4 years ago by code423n4
  2

• Event Is Defined But Not Used On The Contract (IssuingTokenDeposited)

  #307 opened 4 years ago by code423n4
  2

• Possible trolling during deployemnt

  #280 opened 4 years ago by code423n4
  2

• Frontrun setRJoe

  #288 opened 4 years ago by code423n4
  2

• Mark unchanging variables immutable

  #274 opened 4 years ago by code423n4
  2

• Owner can DoS `withdrawAVAX()` function

  #276 opened 4 years ago by code423n4
  3

• Error never thrown

  #278 opened 4 years ago by code423n4
  0

• Cache internal call result

  #279 opened 4 years ago by code423n4
  1

• Use constructors

  #282 opened 4 years ago by code423n4
  0

• Gas Optimization: `> 0` is less efficient than `!= 0` for uint in require condition

  #283 opened 4 years ago by code423n4
  1

• Re-entrancy protection

  #285 opened 4 years ago by code423n4
  1

• Use safe transfers and approvals

  #289 opened 4 years ago by code423n4
  1

• Unsafe call to decimals()

  #291 opened 4 years ago by code423n4
  0

• Cache phase3Start

  #292 opened 4 years ago by code423n4
  1

• Separate issuer functions from regular users

  #294 opened 4 years ago by code423n4
  0

• Unchecked math operations

  #295 opened 4 years ago by code423n4
  0

• Unchecked math operations

  #296 opened 4 years ago by code423n4
  0

• Repeated storage access

  #300 opened 4 years ago by code423n4
  0

• Cache storage variables

  #297 opened 4 years ago by code423n4
  1

• Long revert messages

  #299 opened 4 years ago by code423n4
  1

• _atPhase optimization

  #302 opened 4 years ago by code423n4
  1

• Reasonable upper limits for phase durations

  #303 opened 4 years ago by code423n4
  0

• Gas Optimization: Use type(uint256).max instead of block.timestamp

  #309 opened 4 years ago by code423n4
  0

• Cheaper operation should be done first in an if statement

  #319 opened 4 years ago by code423n4
  1

• Minimize operations

  #277 opened 4 years ago by code423n4
  1

• Gas Optimziation: Unnecessary pairBalance call

  #310 opened 4 years ago by code423n4
  1

• Gas Optimization: Variables that could be set immutable

  #284 opened 4 years ago by code423n4
  0

• Gas Optimization: fmul optimization

  #290 opened 4 years ago by code423n4
  0

• ERC20 transfer might fail

  #320 opened 4 years ago by code423n4
  1

• != 0 is cheaper than >0 for uint

  #318 opened 4 years ago by code423n4
  1

• Save Gas With The Unchecked Keyword (LaunchEvent.sol)

  #308 opened 4 years ago by code423n4
  1

• factory can be set to address(0)

  #306 opened 4 years ago by code423n4
  1

• router can be set to address(0)

  #305 opened 4 years ago by code423n4
  1

• penaltyCollector can be set to address(0)

  #304 opened 4 years ago by code423n4
  1

• need to check if pending value = 0

  #298 opened 4 years ago by code423n4
  1