The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Dynamic loops can DoS the system

wardenpaul

Summary

Malicious actors can make the system inoperable by pushing too many entries into dynamic arrays.

Vulnerability Details

There are several loops in the contract which can eventually grow so large as to make future operations of the contract cost too much gas to fit in a block. Additionally, using unbounded loops incurs a lot of avoidable gas costs for all token transactions.

Examples of such arrays that can grow unlimited are pendingStakes and holders:

function increasePosition(uint256 _tstVal, uint256 _eurosVal) external {
...
pendingStakes.push(PendingStake(msg.sender, block.timestamp, _tstVal, _eurosVal));
addUniqueHolder(msg.sender);
}
function addUniqueHolder(address _holder) private {
for (uint256 i = 0; i < holders.length; i++) {
if (holders[i] == _holder) return;
}
holders.push(_holder);
}

Then contract has to iterate over these arrays, e.g. when calculating a total number of tokens:

function getTstTotal() private view returns (uint256 _tst) {
for (uint256 i = 0; i < holders.length; i++) {
_tst += positions[holders[i]].TST;
}
for (uint256 i = 0; i < pendingStakes.length; i++) {
_tst += pendingStakes[i].TST;
}
}

Anyone can create new accounts and push entries until it becomes impossible to operate the contract.

Impact

Iterating through the arrays of unknown sizes might consume all the gas provided (run out of gas) if too many elements are pushed. This might be less relevant on Arbitrum where gas limits are lifted, but concerning if deployed on other chains, especially Mainnet.

Tools Used

Manual review.

Recommendations

Consider refactoring the codebase to avoid such iterations. Add upper limits (global, per address, etc), pagination, and other appropriate improvements.

Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

pendingstake-dos

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

pendingstake-high

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.