code-423n4 / 2022-01-trader-joe-findings

2 stars 0 forks source link

LaunchEvent's createPair calls token.decimals() twice #264

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

hyh

Vulnerability details

Impact

Gas is overspent first of all on function call

Proof of Concept

wavaxReserve * 10**token.decimals() is computed twise when the condition is true:

https://github.com/code-423n4/2022-01-trader-joe/blob/main/contracts/LaunchEvent.sol#L396-398

Recommended Mitigation Steps

Consider saving wavaxReserve * 10**token.decimals() to memory and reuse inside the if statement

cryptofish7 commented 2 years ago

Duplicate of #236