At L132, _token.transferFrom() can be used to re-enter the createRJLaunchEvent() function, before the storage change at L147-149.
This will allow the attacker to create multiple launchEvent contracts and get them listed in allRJLaunchEvents.
Even though there is no significant impact as far as we can tell from the smart contract code. We believe this is still unexpected and may cause other parts of the system, say the frontend to malfunction in some cases.
Recommendation
Consider moving L132 _token.transferFrom() to after L147-149 to prevent re-entrance.
Handle
WatchPug
Vulnerability details
https://github.com/code-423n4/2022-01-trader-joe/blob/119e12d715ececc31478e833297f124cc15d27c2/contracts/RocketJoeFactory.sol#L97-L154
At L132,
_token.transferFrom()
can be used to re-enter thecreateRJLaunchEvent()
function, before the storage change at L147-149.This will allow the attacker to create multiple
launchEvent
contracts and get them listed inallRJLaunchEvents
.Even though there is no significant impact as far as we can tell from the smart contract code. We believe this is still unexpected and may cause other parts of the system, say the frontend to malfunction in some cases.
Recommendation
Consider moving L132
_token.transferFrom()
to after L147-149 to prevent re-entrance.