The Standard

Summary

Unlimited pendingStakes array length can cause DoS due to the gas limit per block. It can be used to prevent liquidation. It is worth considering that the gas limit in L2 networks may be less than in the mainnet.

Vulnerability Details

When calling the function LiquidationPool.distributeAssets, the consolidatePendingStakes function is called, which updates the size of the staked assets. Due to the fact that the size of the pendingStakes array through which the loop passes is not limited, DoS function may occur due to the gas limit in the block. The attacker can exploit this to prevent vault liquidation.

Impact

The key functions of the protocol for vault liquidation will be completely blocked.

Tools used

Manual Review

Recommendations

Consider optimizing the contract to eliminate unnecessary gas consumption, introducing a minimum deposit amount, limiting the number of possible applications for each address and limiting the pendingStakes array length.