code-423n4 / 2022-01-trader-joe-findings

2 stars 0 forks source link

withdrawAVAX and withdraw can do unchecked subtraction #257

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

hyh

Vulnerability details

Impact

Gas is overspent on checks

Proof of Concept

withdrawAVAX:

https://github.com/code-423n4/2022-01-trader-joe/blob/main/contracts/LaunchEvent.sol#L361

withdraw:

https://github.com/code-423n4/2022-01-trader-joe/blob/main/contracts/RocketJoeStaking.sol#L129

Recommended Mitigation Steps

Can use unchecked as subtraction safety is already required in both cases

cryptofish7 commented 2 years ago

Duplicate of #233