# Pair pre-creation disables Launchpad rewards hooks leading to no fees accrued or distributed

Anyone can pre-create a Launchpad token/quote pair, locking zero fee hooks so the canonical market never accrues or distributes staker rewards.

- Payout: Contest reward
- Severity: medium
- Program: GTE
- Credited: 0xAsen
- Disclosed: 2026-02-05
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-08-gte-perps-and-launchpad#m-18
- Library page: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-18
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:race-window technique:source-review vuln:access-control vuln:business-logic

**Target:** Uniswap V2-style pair factory and pair contracts (GTELaunchpadV2PairFactory / GTELaunchpadV2Pair)
**Root cause:** Factory initializes launchpadLp/launchpadFeeDistributor only when msg.sender == launchpad, otherwise zero; the pair is then locked as canonical in getPair. Pair gates all fee accrual/distribution on launchpadFeeDistributor > 0.
**Steps:**
1. Before graduation, call `GTELaunchpadV2PairFactory.createPair(token, quote)` from a non-Launchpad EOA.
2. Factory sets `_lp = address(0)`, `_dist = address(0)`, initializes pair, and writes it to `getPair[token0][token1]`.
3. Verify `pair.launchpadFeeDistributor()` returns 0x0.
4. Launchpad later attempts createPair and reverts with PAIR_EXISTS; graduation adds liquidity to this canonical pair.
5. All swaps hit `launchpadFeeDistributor > address(0)` false, so `_getLaunchpadFees` and `_distributeLaunchpadFees` never run.
**How found:** Code reading of the factory's caller-conditioned initialization ternary and the pair's `launchpadFeeDistributor > 0` gating; noticed getPair locking prevents remediation.
**Exploitation:** Single cheap transaction pre-creating the pair with zero hooks; no liquidity or approvals needed. The canonical pair is permanently locked with disabled fee logic, so all future trading volume yields zero Launchpad rewards to stakers.
**Insight:** When a factory branches initialization on msg.sender, check whether an unprivileged caller can front-run the privileged path and lock the canonical mapping entry; caller-conditioned state that is later immutable is a permanent-DoS primitive.