Submission Details
Severity:
Unbounded loop in Lender.sol functions may revert.
Summary
Functions seizeLoan(), borrow(), repay() accepts unbounded length of arrays as parameters and all these contains transactions calls. If array contains large number of tokens, it will result in out-of-gas error and cause a revert.
function seizeLoan(uint256[] calldata loanIds) public {
for (uint256 i = 0; i < loanIds.length; i++) {
uint256 loanId = loanIds[i];
...
// transfer the protocol fee to governance
IERC20(loan.collateralToken).transfer(feeReceiver, govFee);
// transfer the collateral tokens from the contract to the lender
IERC20(loan.collateralToken).transfer(
loan.lender,
loan.collateral - govFee
);
...
}
}
Tools Used
manual code review
Recommendations
It is recommended to restrict the array length
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628 USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.