Submission Details
Severity:
Use external call on loops may fail because run out of gas
Summary
Use external call on loops may fail and make protocol on DOS state for a certain time because run out of gas
Vulnerability Details
File : SDLPoolCCIPController.sol
for (uint256 i = 0; i < _tokens.length; ++i) {
IERC20 tokenToTransfer = IERC20(_tokens[i]);
tokenToTransfer.safeTransfer(_receiver, tokenToTransfer.balanceOf(address(this)));
}
File : SDLPoolCCIPControllerSecondary.sol
for (uint256 i = 0; i < numRewardTokens; ++i) {
rewardTokens[i] = _message.destTokenAmounts[i].token;
IERC20(rewardTokens[i]).safeTransfer(sdlPool, _message.destTokenAmounts[i].amount);
}
Impact
External calls may fail because run out of gas
Tools Used
Manual review
Recommended Mitigation
Avoid combining multiple calls in a single transaction, especially when calls are executed as part of a loop.
Always assume that external calls can fail.
If possible, use pull over push strategy for external calls.
Prize pool breakdown
Total prize
27,500 USDC
nSLOC
1,41419 USDC / LOC
25,000 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.