The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Unbounded Growth in Pending Stakes Array allows to grief and break liquidationPool operations

JrNet

Summary

The increasePosition function in LiquidationPool.sol allows any stake amount, leading to the creation of new stakes in the pendingStakes[] array. These pending stakes undergo processing the day after staking through consolidatePendingStakes(). The function is triggered on every increasePosition, decreasePosition, and distributeAssets call. Exploiting this, a malicious actor can repeatedly transfer minuscule amounts (1 wei) of EUROs / TST tokens, causing an infinite increase in the length of the pending stakes array. This manipulation results in excessive gas consumption or reverts during subsequent interactions.

// File: LiquidityPool.sol
function increasePosition(uint256 _tstVal, uint256 _eurosVal) external {
...
if (_tstVal > 0) IERC20(TST).safeTransferFrom(msg.sender, address(this), _tstVal);
if (_eurosVal > 0) IERC20(EUROs).safeTransferFrom(msg.sender, address(this), _eurosVal);
@> // @audit allowing any amt of stakes result in grief other users - cost to perform attack is gas fee and very few asset tokens
pendingStakes.push(PendingStake(msg.sender, block.timestamp, _tstVal, _eurosVal));
...
}

Vulnerability Details

  1. Attacker mints 1 EUROs token from Vault.

  2. Calls increasePosition with 1 wei, repeating the process multiple times (e.g., 1^18 times).

  3. The consolidatePendingStakes function, which is gas-intensive, processes the pending stakes.

    • Iterates through pending stakes.

    • Deletes processed pending stakes by left-shifting elements in the array.

  4. Interactions with decreasePosition, distributeAssets, or increasePosition on the following day lead to reverts or significant gas consumption.

Impact

The vulnerability results in failed or excessively gas-consuming interactions, affecting the liquidity pool.

Tools Used

Manual Review

Recommendations

Implement checks to ensure that stake amounts are within reasonable limits, preventing abuse with extremely small values.

Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

pendingstake-dos

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

pendingstake-high

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.