The Standard

Summary

The pendingStakes array in the LiquidationPool contract is unbounded, which could lead to a potential Denial of Service (DoS) vulnerability. The array is utilized in functions like consolidatePendingStakes and distributeFees, both of which are called within critical functions (increasePosition, decreasePosition, distributeAssets).

Vulnerability Details

The consolidatePendingStakes function iterates over the entire pendingStakes array, and the same goes for the distributeFees function. A malicious user could repeatedly increase their position, causing the pendingStakes array to grow without bounds. This unbounded growth could lead to excessive gas consumption and result in a DoS attack.

Impact

The potential impact is an increased risk of insolvency and a DoS attack on the LiquidationPool contract due to unbounded growth of the pendingStakes array.

Tools Used

Manual Review

Recommendations

It is recommended to add a minimum amount requirement for increasing positions to mitigate the risk of unbounded growth of the pendingStakes array. Implementing a minimum increase position amount would discourage malicious users from causing excessive growth and reduce the risk of a DoS attack.