# Possible DoS attack when creating Joins in Wand

Permissionless CREATE2 JoinFactory lets an attacker pre-occupy deterministic Join addresses for common assets, making Wand's Join deployment revert and DoS governance actions.

- Payout: Audit contest
- Severity: medium
- Program: Yield
- Disclosed: 2021-07-23
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-05-yield-findings/issues/70
- Library page: https://bugbountylibrary.com/r/c4%3A2021-05-yield%3AM-07
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:race-window vuln:access-control vuln:dos

**Target:** JoinFactory/Wand smart contracts (CREATE2 Join deployment)
**Root cause:** Join addresses are deterministically derived via CREATE2 with salt keccak256(asset), and createJoin is permissionless, so anyone can deploy a contract at the same address first, causing Wand's deployment to revert.
**Steps:**
1. Attacker calls permissionless `createJoin` on JoinFactory to deploy a fake Join at the CREATE2 address for a common asset (DAI, USDC, ETH) before Wand does.
2. Wand later attempts `new Join{salt: keccak256(abi.encodePacked(asset))}()` and reverts because the address is occupied.
3. Alternatively, monitor mempool for `addAsset` calls on Wand and front-run with a createJoin for the new asset, making the benign transaction fail.
**How found:** Noticed Join address is uniquely determined by CREATE2 salt of the asset and that createJoin lacks access control, then reasoned an attacker could occupy those addresses first.
**Exploitation:** Attacker pre-deploys Joins at deterministic CREATE2 addresses for common or newly added assets, either proactively or by front-running addAsset transactions, causing Wand's Join deployment to revert and blocking governance actions.
**Insight:** When a factory uses CREATE2 with a predictable salt and no access control, check whether any privileged deployer depends on that address being free; front-running addAsset-style calls can grief deterministic deployments.