In the current implementation, RocketJoeFactory.sol#createRJLaunchEvent() can be called by anyone with at least 1 Wei of _token.
This allows a malicious user or attacker to call createRJLaunchEvent() with minimal cost and stop others, especially the platform itself or the rightful issuer of the token from creating the RJLaunchEvent.
Recommendation
Consider making createRJLaunchEvent() only callable by the owner of RocketJoeFactory.
Handle
WatchPug
Vulnerability details
https://github.com/code-423n4/2022-01-trader-joe/blob/119e12d715ececc31478e833297f124cc15d27c2/contracts/RocketJoeFactory.sol#L97-L132
In the current implementation,
RocketJoeFactory.sol#createRJLaunchEvent()
can be called by anyone with at least 1 Wei of_token
.This allows a malicious user or attacker to call
createRJLaunchEvent()
with minimal cost and stop others, especially the platform itself or the rightful issuer of the token from creating the RJLaunchEvent.Recommendation
Consider making
createRJLaunchEvent()
only callable by the owner ofRocketJoeFactory
.