The Standard

Summary

The current smart contract is vulnerable to a Denial-of-Service (DOS) attack due to the potential for an unbounded number of holders.

Vulnerability Details

The issue arises when a user invokes the LiquidationPool::increasePosition function (which internally calls LiquidationPool::addUniqueHolder) without providing any EUROs and TST. This allows an attacker to create numerous positions without any associated cost. Furthermore, the length of the holders array is used in multiple functions, potentially leading to a gas-related DOS attack.

Impact

The vulnerability enables an attacker to flood the system with a large number of holders, leading to a gas-related DOS attack.

Tools Used

The vulnerability was identified using manual inspection.

Recommendations

Recommendations:

1. Implement a minimum requirement for being a holder by setting thresholds for EURO and TST payments.
   uint256 public s_minPositionEURO;
   uint256 public s_minPositionTST;
   Enforce that a user cannot become a holder without meeting these payment criteria.

2. Consider using a Mapping instead of an array for more efficient handling of holders.

Mappings provide quicker lookups and can help mitigate the gas-related DOS attack potential.

By implementing these recommendations, the smart contract can enhance its security and resilience against potential DOS attacks.