# LamboFactory can be permanently DoS-ed due to createPair call reversal

Attacker pre-creates a Uniswap V2 pair for the predictable next clone address, making every LamboFactory.createLaunchPad revert permanently.

- Payout: Contest reward
- Severity: high
- Program: Lambo.win
- Credited: zxriptor
- Disclosed: 2025-02-03
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2024-12-lambowin#h-02
- Library page: https://bugbountylibrary.com/r/c4%3A2024-12-lambowin%3AH-02
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** LamboFactory.createLaunchPad / UniswapV2Factory.createPair
**Root cause:** LamboToken clone address is deterministic (CREATE opcode, factory address + nonce), so an attacker can pre-register a Uniswap V2 pair for that address; Uniswap's PAIR_EXISTS check then makes the factory's createPair call revert forever.
**Steps:**
1. Compute next clone address: `keccak256(rlp([lamboFactory, nonce]))[12:]`
2. Call `UniswapV2Factory.createPair(predictedToken, WETH)` from attacker EOA
3. Any subsequent `LamboFactory.createLaunchPad` reverts on `require(getPair[token0][token1] == address(0), 'UniswapV2: PAIR_EXISTS')`
4. Repeat for each new nonce to keep factory bricked
**How found:** Noticed createLaunchPad calls UniswapV2Factory.createPair and that Clones.clone uses CREATE with a predictable nonce, making the token address computable in advance; then checked Uniswap's PAIR_EXISTS require to confirm the revert.
**Exploitation:** Attacker frontruns each launch by pre-creating the Uniswap pair for the deterministic clone address; the factory's createPair call reverts, blocking all launches with no recovery path.
**Insight:** When a factory deploys via CREATE and immediately registers the child in an external registry keyed by address, the child address is predictable — pre-registering it in the registry bricks the factory. Look for CREATE (non-deterministic) + external registry calls in deploy flows.