The Standard

Summary

An Attacker can perform a Denial of Service attack on the protocol.

By Spamming the LiquidationPool::increasePosition function with just 1 wei worth of EUROs or TST, an attacker can create a lot of pendingStakes. This makes the gas cost of looping through the pendingStakes array, more than the block gas limit.

The pendingStakes array is looped through in the functions

- `LiquidationPool::consolidatePendingStakes()`
- `LiquidationPool::getTstTotal()`

Vulnerability Details

Proof of Concept:

An attacker has to do the following steps to exploit this issue. A well-funded attacker with enough ETH for gas can do the following to DOS the protocol.

1. Create a contract which will spam the LiquidationPool::increasePosition() function.

2. Transfer a small amount of EUROs or TST to the attack contract

3. Call the increasePosition with 1 wei of TST or EUROs.

4. If the attack completes within 24 hrs then the Denial of Service attack is successful.

Results

Impact

his creates a Denial of Service attack the following functions

- `LiquidationPool::increasePosition()`
- `LiquidationPool::decreasePosition()`
- `LiquidationPool::distributeFees()`
- `LiquidationPool::distributeAssets()`

This stops all the Liquidations of the Collateral in smartVaults, leading to bad debt throughout the system.

This also affect increasing and decreasing staking positions in the LiquidationPool contract. Thus also making the staked assets in the LiquidationPool stuck in the contract.

Tools Used

Foundry