# CREATE2 address of the uniswap pair used by LaunchPad does not match address of pair deployed by GTELaunchpadV2PairFactory

Launchpad's CREATE2 pairFor salt omits LP and fee-distributor args, so it computes a wrong pair address, permanently bricking bonding-curve completion and endRewards.

- Payout: Contest reward
- Severity: high
- Program: GTE
- Credited: hgrano
- Disclosed: 2026-02-05
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2025-08-gte-perps-and-launchpad#h-08
- Library page: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-08
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Launchpad bonding-curve contract / UniswapV2 pair factory
**Root cause:** pairFor computes the pair address with salt keccak(token0,token1) only, while GTELaunchpadV2PairFactory deploys with salt including token0, token1, launchpadLp and launchpadFeeDistributor, yielding a different CREATE2 address.
**Steps:**
1. Call GTELaunchpadV2PairFactory::createPair(quoteToken, launchToken) before bonding curve completes.
2. Buyer purchases all remaining bonding-curve tokens; Launchpad.sol:483 calls uniV2Factory.createPair which reverts since pair exists, caught by try/catch leaving pair at pairFor value.
3. pairFor (L569-587) returns address from keccak(hex"ff", factory, keccak(token0,token1), initCodeHash) — no LP/feeDistributor salt.
4. At L491 the code checks pair is a contract; wrong address has no code, so tx reverts and bonding state is stuck.
5. Separately, when all buyers sell back and LaunchToken.sol:147 triggers endRewards, Launchpad.sol:436 casts pairFor(...) to IGTELaunchpadV2Pair; no contract there, so endRewards reverts.
**How found:** Code-reading of pairFor's CREATE2 salt versus the factory's deployment salt, noticing the try/catch swallows the createPair revert and leaves the stale computed address.
**Exploitation:** Any user can pre-create the pair via the public factory, then a buyer consuming the bonding curve triggers the mismatched-address path; the launch is permanently stuck in bonding state and rewards cannot be ended.
**Insight:** When a contract computes a CREATE2 address locally, diff its salt/init-code against the actual deployer's salt; try/catch around createPair hides the mismatch and leaves a stale address.