Submission Details
Severity:
getLockIdsByOwner gas cost can be exploited by malicious agent
Summary
'getLockIdsByOwner' uses array structure and maxLockId to match lockId and lock owner. By spamming/creating locks with value of 1 the attacker can increase gas cost of 'getLockIdsByOwner' significantly, which, while being a "view" function can be used elsewhere is dependencies.
Vulnerability Details
Impact
MEDIUM
Tools Used
Manual review
Recommendations
Change iteration to mapping/array data structure, where key would be owner address and array contents are lockIds.
Updates
Lead Judging Commences
0kage over 1 year ago
Submission Judgement Published Assigned finding tags:
unbounded-locks
getLockIdsByOwner could be very gas intensive and revert
Prize pool breakdown
Total prize
27,500 USDC
nSLOC
1,41419 USDC / LOC
25,000 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.