Submission Details
Severity:
Unbounded array length
Summary
Unbounded array inputs
Vulnerability Details
Inputs
function manageUsersInPrivatePool(
uint256 poolId_,
address[] calldata users_,
uint256[] calldata amounts_
) that are looped through users
for (uint256 i; i < users_.length; ++i) {
address user_ = users_[i];
uint256 amount_ = amounts_[i];
uint256 deposited_ = usersData[user_][poolId_].deposited;
if (deposited_ < amount_) {
_stake(user_, poolId_, amount_ - deposited_, currentPoolRate_);
} else if (deposited_ > amount_) {
_withdraw(user_, poolId_, deposited_ - amount_, currentPoolRate_);
}
}
Impact
Can lead to Out Of Gas due to looping over array in function
Tools Used
Manual Analysis
Recommendations
Recommended based on various tests, gas optimizations, runs and checks bound the array size ot a certain length
e.g require(users_ <= 20) e.g so can only update 20 users in private pool at a time
Updates
Prize pool breakdown
Total prize
22,500 USDC
nSLOC
1,05421 USDC / LOC
20,000 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.