The Standard

Summary

DoS Attack in the getAssests() function

Vulnerability Details and Impact

If a malicious actor triggers this function with a large number of tokens, it could consume a significant amount of gas, potentially causing the transaction to fail due to exceeding the block gas limit. This could disrupt the normal operation of the contract and make it inaccessible to legitimate users.

• Attacker creates large array of accepted tokens

• Attacker calls getAssets(), passing in the large array of tokens

• getAssets() function iterates over each token in the array, calling getAssetBalance() for each one

• Each call to getAssetBalance() consumes gas. If the number of tokens is large enough, the total gas consumed could exceed the block gas limit, causing the transaction to fail

Recommendations

• Implement a limit on the number of tokens that can be processed in a single transaction