search

code-423n4 / 2022-01-trader-joe-findings

2 stars 0 forks source link

Misleading comment in `LaunchEvent.getReserves` #209

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Handle

cmichel

Vulnerability details

LaunchEvent.getReserves: The comment says: @notice Returns the current balance of the pool. The "of the pool" part can be misleading as the tokenIncentivesBalance are never part of the pool pair. Consider changing this to "Returns the outstanding balance of the launch event contract".

cryptofish7 commented 2 years ago

Fix: https://github.com/traderjoe-xyz/rocket-joe/commit/dbd19cc400abb5863edfc0443dd408ba5ae3e99a

Disagree with severity, should be 0

dmvt commented 2 years ago 
1 — Low (L): vulns that have a risk of 1 are considered “Low” severity when assets are not at risk. Includes state handling, function incorrect as to spec, and issues with comments.