Closed code423n4 closed 2 years ago
Jujic
The functions initialize() can be called by anyone the first time, which allows an attacker to set the address rocketJoeFactory of the contract .
initialize()
rocketJoeFactory
https://github.com/code-423n4/2022-01-trader-joe/blob/a1579f6453bc4bf9fb0db9c627beaa41135438ed/contracts/RocketJoeToken.sol#L25-L32
function initialize() external { require( address(rocketJoeFactory) == address(0), "RocketJoeToken: already initialized" ); rocketJoeFactory = IRocketJoeFactory(msg.sender); }
Remix
Add modifier
Duplicate of #68
Duplicate of #8
Handle
Jujic
Vulnerability details
Impact
The functions
initialize()
can be called by anyone the first time, which allows an attacker to set the addressrocketJoeFactory
of the contract .Proof of Concept
https://github.com/code-423n4/2022-01-trader-joe/blob/a1579f6453bc4bf9fb0db9c627beaa41135438ed/contracts/RocketJoeToken.sol#L25-L32
Tools Used
Remix
Recommended Mitigation Steps
Add modifier