The Standard

Summary

In the contract LiquidatePool.sol we have 2 functions that depend on the loop over holders.length:

distributeAssets()

distributeFees()

A malicious user can keep generating new addresses and minting minimal amounts of tokens to make the aforementioned functions exceed the block gas limit, stopping the distribution of fees and assets.

Note: There is also another private functions that also depends on holders.length

Vulnerability Details

To prove that we can add infinite addresses to the holders array, we need to add to the hardhat.config.js file:

Now, we are going to create the PoC:

1. We set the hardhat signers to 1000 to probe that we can add an unlimited addresses.

2. We created the LiquidationPool.getHoldersLength() to return the number of users in the liquidationPool.

3. valueFee0 is the mint value where the Fee calculation is 0 so no cost to the attacker.

   • NOTE: This is also a vulnerability, also reported.

4. We add the 1000 malicious users to holders array.

5. We could continue adding users, at one point, the functions distributeAssets() and distributeFees() (and the privates ones) will fail due to gas limit.

Impact

The protocol will potentially stop distributing fees and assets, so this is a HIGH vulnerability that needs to be addressed before the protocol is deployed.

Tools Used

Hardhat, manual check.

Recommendations

There are different approaches we can take:

1. Process the holders.length in batches.

2. Change the distribution to a dividensPerShare, for example, where we have created a fee x atomic value distribution or similar.