stake.link

Summary

The distributeRewards function could potentially consume a lot of gas if there are many tokens and destinations to process. This could lead to high transaction costs.The contract contains several loops that iterate over arrays of tokens and chains. If these arrays grow large, it could lead to high gas costs and potentially hit block gas limits, causing transactions to fail.

Vulnerability Details

function distributeRewards() external onlyRewardsInitiator {
uint256 totalRESDL = ISDLPoolPrimary(sdlPool).effectiveBalanceOf(address(this));
address[] memory tokens = ISDLPoolPrimary(sdlPool).supportedTokens();
uint256 numDestinations = whitelistedChains.length;

    ISDLPoolPrimary(sdlPool).withdrawRewards(tokens);

    uint256[][] memory distributionAmounts = new uint256[][](numDestinations);
    for (uint256 i = 0; i < numDestinations; ++i) {
        distributionAmounts[i] = new uint256[](tokens.length);
    }

    for (uint256 i = 0; i < tokens.length; ++i) {
        address token = tokens[i];
        uint256 tokenBalance = IERC20(token).balanceOf(address(this));

        address wrappedToken = wrappedRewardTokens[token];
        if (wrappedToken != address(0)) {
            IERC677(token).transferAndCall(wrappedToken, tokenBalance, "");
            tokens[i] = wrappedToken;
            tokenBalance = IERC20(wrappedToken).balanceOf(address(this));
        }

        uint256 totalDistributed;
        for (uint256 j = 0; j < numDestinations; ++j) {
            uint64 chainSelector = whitelistedChains[j];
            uint256 rewards = j == numDestinations - 1
                ? tokenBalance - totalDistributed
                : (tokenBalance * reSDLSupplyByChain[chainSelector]) / totalRESDL;
            distributionAmounts[j][i] = rewards;
            totalDistributed += rewards;
        }
    }

    for (uint256 i = 0; i < numDestinations; ++i) {
        _distributeRewards(whitelistedChains[i], tokens, distributionAmounts[i]);
    }
}

Impact

The contract contains several loops that iterate over arrays of tokens and chains. If these arrays grow large, it could lead to high gas costs and potentially hit block gas limits, causing transactions to fail.

Tools Used

Recommendations