Foundry DeFi Stablecoin CodeHawks Audit Contest
Cyfrin
DeFiFoundry
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium

[M-02] Potential Denial-of-Service (DoS) Attack due to Gas Block Limit in `getAccountCollateralValue` Function

maanvad3r

Summary

The smart contract DSCEngine.sol contains a Denial-of-Service (DoS) vulnerability that allows an attacker to disrupt normal contract operations by submitting a large number of unique collateral tokens. The vulnerability arises from the excessive gas consumption during the execution of the getAccountCollateralValue function, which iterates through deposited collateral tokens and fetches their USD values to calculate the total collateral value. When an attacker deposits a substantial number of different collateral tokens, the function consumes more gas than the block limit, causing it to become unresponsive. As a result, legitimate users trying to interact with the contract face a denial of service, rendering essential functionalities unusable.

Vulnerability Details

The getAccountCollateralValue function loops through each collateral token deposited by a user, retrieves their corresponding USD values using the getUsdValue function, and accumulates the total collateral value in USD. However, the function lacks proper gas checks and constraints on the number of iterations, making it susceptible to abuse.

Lack proper gas checks:

for (uint256 i = 0; i < s_collateralTokens.length; i++) { //@audit possible DOS due to gas block limit when collateralToken lenght is more than intended
address token = s_collateralTokens[i];
uint256 amount = s_collateralDeposited[user][token];
totalCollateralValueInUsd += getUsdValue(token, amount);
}
​

Impact

A DoS attack on the getAccountCollateralValue function can severely impact the contract's functionality. If an attacker deliberately deposits a large number of collateral tokens, the function's gas consumption can surpass the gas block limit. As a result, the function will be unable to complete its execution, leading to a denial of service for other users trying to interact with the contract.

Tools Used

  • VS code

  • Manual review

Recommendations

One potential fix would be to add a gas check after each iteration for example:

function getAccountCollateralValue(address user) public view returns (uint256 totalCollateralValueInUsd) {
for (uint256 i = 0; i < s_collateralTokens.length; i++) {
address token = s_collateralTokens[i];
uint256 amount = s_collateralDeposited[user][token];
totalCollateralValueInUsd += getUsdValue(token, amount);
// Add a gas check to prevent exceeding block limit
require(gasleft() > MINIMUM_GAS_LEFT, "Gas limit exceeded");
}
return totalCollateralValueInUsd;
}
​

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.