Closed code423n4 closed 2 years ago
pedroais
Timelock could be set to 0
Lack of input check for user timelock, it should always be greater than 0. https://github.com/code-423n4/2022-01-trader-joe/blob/a1579f6453bc4bf9fb0db9c627beaa41135438ed/contracts/LaunchEvent.sol#L246
Require user timelock != 0
This is by design
sometimes you just don't want a timelock. Invalid.
Handle
pedroais
Vulnerability details
Impact
Timelock could be set to 0
Proof of Concept
Lack of input check for user timelock, it should always be greater than 0. https://github.com/code-423n4/2022-01-trader-joe/blob/a1579f6453bc4bf9fb0db9c627beaa41135438ed/contracts/LaunchEvent.sol#L246
Recommended Mitigation Steps
Require user timelock != 0