setFlashLoanFee() lacks input validation

[code423n4]

Lines of code

https://github.com/code-423n4/2022-10-traderjoe/blob/main/src/LBFactory.sol#L474

Vulnerability details

Impact

Owner could deny users from using flash loans.

Proof of Concept

 function setFlashLoanFee(uint256 _flashLoanFee) external override onlyOwner {
        uint256 _oldFlashLoanFee = flashLoanFee;

        if (_oldFlashLoanFee == _flashLoanFee) revert LBFactory__SameFlashLoanFee(_flashLoanFee);

        flashLoanFee = _flashLoanFee;
        emit FlashLoanFeeSet(_oldFlashLoanFee, _flashLoanFee);
    }

_flashLoanFee is not checked here, so it can be set to any value by a malicious owner.

When a user attempts to call flashLoan() from LBPair.sol the following function is called:

function _getFlashLoanFee(uint256 _amount, uint256 _fee) internal pure returns (uint256) {
        return (_amount * _fee) / Constants.PRECISION;
    }

If _fee is large, this function will revert, which will prevent a user from using flash loan functionality.

Tools Used

vim

Recommended Mitigation Steps

Add upper and lower bounds checks.

[GalloDaSballo]

Dup of #138

[c4-judge]

GalloDaSballo marked the issue as not a duplicate

[c4-judge]

GalloDaSballo marked the issue as duplicate of #139

[Simon-Busch]

Marked this issue as Satisfactory as requested by @GalloDaSballo