Summary

Potential Gas Limit Issue in combineShorts Function

Vulnerability Details

Gas limit vulnerability (File Path: 2023-09-ditto/contracts/facets/ShortRecordFacet.sol
Line: 123)

The combineShorts function does loop over the ids array without checking its length. If the array is too large, the function could indeed run out of gas, causing the transaction to fail.

Impact

If a function performs too many operations, such as looping over a large array, it could exceed this limit, causing the transaction to fail.

Tools Used

Manual

Recommendations

To resolve this issue, you could implement a limit on the size of the ids array that can be passed to the combineShorts function. This would prevent the function from iterating over an excessively large array and potentially exceeding the gas limit.

Here is a simple way to implement this:

This change ensures that the combineShorts function will not attempt to combine more than MAX_SHORTS_COMBINE shorts at once, preventing potential gas limit issues. The exact limit can be adjusted based on your specific needs and gas usage of the function.