# Owner of LaunchEvent token has the ability to DOS attack the event

LaunchEvent token owner pre-creates the JoePair with a dust liquidity deposit, making createPair revert and blocking LP/incentive withdrawals.

- Payout: Audit contest
- Severity: medium
- Program: Trader Joe
- Found by: Ruhum
- Disclosed: 2022-03-07
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-01-trader-joe-findings/issues/121
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-trader-joe%3AM-02
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** LaunchEvent.sol / JoeFactory pair creation
**Root cause:** createPair() reverts if a JoePair for the token pair already exists with totalSupply > 0; anyone holding AVAX and the launch token can pre-create the pair, so the LaunchEvent's pair variable is never initialized.
**Steps:**
1. Acquire AVAX and the LaunchEvent token (dev team/trusted parties hold it).
2. Call JoeFactory to create the JoePair for token/AVAX.
3. Deposit a small amount of liquidity so JoePair totalSupply > 0.
4. LaunchEvent.createPair() now reverts at the existing-pair check (LaunchEvent.sol L382-389).
5. pair state var stays uninitialized (L422), making withdrawLiquidity() (L439) and withdrawIncentives() (L469) unreachable.
**How found:** Code reading of createPair's existing-pair check combined with the fact that JoeFactory pair creation is permissionless and only the issuer holds the launch token.
**Exploitation:** Token owner pre-creates and seeds the JoePair with dust liquidity, causing LaunchEvent.createPair to revert; LP depositors cannot withdraw LP tokens or incentives. RocketJoe owner can enable emergency withdrawal returning AVAX, but users lose burned rJOE and gas, while the issuer recovers its deposit.
**Insight:** When a contract assumes it will be the first to create a canonical DEX pair, check whether pair creation is permissionless and whether a pre-existing pair with nonzero totalSupply blocks initialization; dust-seeded pairs are a cheap DoS primitive.