search

code-423n4 / 2022-01-trader-joe-findings

2 stars 0 forks source link

possibility of minting rJOE tokens before ownership is changed to RocketJoeStaking #261

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Handle

hubble

Vulnerability details

Impact

There is a possibility of the rJOE tokens in RocketJoeToken.sol to be minted by original owner without staking any JOE, before the ownership is transferred to RocketJoeStaking

Proof of Concept

Contract : RocketJoeToken.sol Line : 37 function mint(address _to, uint256 _amount) external onlyOwner { _mint(_to, _amount); }

Tools Used

Manual review

Recommended Mitigation Steps

The transferOwnership(address) function inherited from Ownable.sol is used to change to a new owner i.e., RocketJoeStaking. In the RocketJoeToken.sol contract, define and override this function with an additional check that the totalSupply <= 0