The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

A Potential DOS of the `SmartVaultManagerV5::vaults` method is possible due to non deletion of the liquidated vaults from the array

inzinko

Summary

When the SmartVaultManagerV5::liquidateVault is called, it does not actually remove the liquidated vault fromt the tokenIds array which leads to a situation where a one point it will become too expensive to call the vaults function as it loops thorugh to all token ids, which will lead to a Denial of service

Vulnerability Details

The vaults function loops through each tokenIds of every vault and returns them as shown below

function vaults() external view returns (SmartVaultData[] memory) {
uint256[] memory tokenIds = smartVaultIndex.getTokenIds(msg.sender);
uint256 idsLength = tokenIds.length;
SmartVaultData[] memory vaultData = new SmartVaultData[](idsLength);
for (uint256 i = 0; i < idsLength; i++) {
uint256 tokenId = tokenIds[i];
vaultData[i] = SmartVaultData({
tokenId: tokenId,
collateralRate: collateralRate,
mintFeeRate: mintFeeRate,
burnFeeRate: burnFeeRate,
status: ISmartVault(smartVaultIndex.getVaultAddress(tokenId)).status()
});
}
return vaultData;

But when a vault gets liquidated, it does not try to remove the tokenId from the tokenIds array as shown below,

function liquidateVault(uint256 _tokenId) external onlyLiquidator {
ISmartVault vault = ISmartVault(smartVaultIndex.getVaultAddress(_tokenId));
try vault.undercollateralised() returns (bool _undercollateralised) {
require(_undercollateralised, "vault-not-undercollateralised");
vault.liquidate();
IEUROs(euros).revokeRole(IEUROs(euros).MINTER_ROLE(), address(vault));
IEUROs(euros).revokeRole(IEUROs(euros).BURNER_ROLE(), address(vault));
emit VaultLiquidated(address(vault));
//@audit A removal of the tokenId from the tokenIds array should be implemented here, so unnecessary loops are not conducted on a already liquidated vaults
} catch {
revert("other-liquidation-error");
}
}

As shown above in that code no Removal method or sequence is performed after the liquidation of the vault is successful

Impact

Potential DOS of the vaults function, due to non removal of liquidated vaults from the tokenIds array

Tools Used

Manual Review

Recommendations

A Liquidated vault should be removed from the tokenIds array which should mitigate the potential issue, but if the protocol does not want to carry out that process due to design, a separate array should be created for liquidated vaults, this will ensure complete Mitigation

Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

informational/invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.