Beanstalk Part 1

Vulnerability Details

The safeBatchTransferFrom function is designed to transfer multiple deposits conforming to the ERC1155 standard. It accepts two arrays, depositIds and amounts, which are iterated over in a loop. An attacker can craft a transaction with oversized arrays for both depositIds and amounts, leading to excessive gas consumption. If the gas used by such a transaction approaches or exceeds the block gas limit, it will fail, wasting the gas spent by the user.

Repeated execution of such transactions could prevent legitimate transactions involving safeBatchTransferFrom from being processed, effectively causing a DoS condition for this function.

Impact

1. Legitimate users may experience failed transactions due to out-of-gas errors, leading to frustration and potential loss of trust in the system.

2. Users attempting to use the function legitimately will incur gas costs without successful transaction completion.

Tools Used

Manual Review

Recommendations

1. Implement checks to limit the size of the depositIds and amounts arrays to prevent excessive iteration.

2. Consider setting a maximum batch size that is reasonable for typical use cases and safe in terms of gas consumption.