# Pair creation can be denied

Anyone can pre-create the WAVAX/token JoeFactory pair during launch phases 1-2, blocking LaunchEvent.createPair and forcing an emergency state.

- Payout: Audit contest
- Severity: medium
- Program: Trader Joe
- Found by: cmichel
- Disclosed: 2022-03-07
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-01-trader-joe-findings/issues/197
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-trader-joe%3AM-12
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** LaunchEvent.createPair / JoeFactory pair creation
**Root cause:** createPair only checks that factory.getPair(WAVAX, token) is zero, but pair creation is permissionless, so a griefer can create the pair first and the require reverts.
**Steps:**
1. During Phase 1 or 2, call `JoeFactory.createPair(WAVAX, _token)` to register the pair.
2. LaunchEvent.createPair then reverts on `require(factory.getPair(wavaxAddress, tokenAddress) == address(0))`.
3. No liquidity can be provided; emergency state must be triggered for withdrawals.
**How found:** Code reading of LaunchEvent.createPair: noticed the require on getPair==0 combined with permissionless factory pair creation, an obvious griefing vector.
**Exploitation:** Griefer front-runs the launch by permissionlessly creating the WAVAX/token pair on JoeFactory before Phase 3, denying the launch event's createPair and forcing an emergency shutdown.
**Insight:** When a contract asserts a permissionless external state is unset (pair==0, slot empty, name unregistered), assume an adversary can set it first; check for front-running/griefing and add slippage or privileged-only guards.