Summary

The potential for Denial of Service (DoS) vulnerabilities in the _build() function primarily arises from the use of two for-loops to iterate over arrays of debtors (mFRAXDebtors and mxcDOTDebtors) and the subsequent execution of actions based on the conditions within these loops.

Vulnerability Details

At first, the function iterates over mFRAXDebtors which involves an external function call to _pushAction():

• https://github.com/Cyfrin/2024-03-Moonwell/blob/e57b8551a92824d35d4490f5e7f27c373be172bd/src/proposals/mips/mip-m17/mip-m17.sol#L101-L120

Then over mxcDOTDebtors which also involves an external function call to _pushAction():

• https://github.com/Cyfrin/2024-03-Moonwell/blob/e57b8551a92824d35d4490f5e7f27c373be172bd/src/proposals/mips/mip-m17/mip-m17.sol#L138-L158

Iteration over these arrays while performing the external calls to _pushAction() could consume a significant amount of gas, potentially leading to an Out of Gas (OOG) error if the transaction does not have enough gas to complete.

Impact

There is a potential for Denial of Service (DoS) vulnerabilities due to OOG

Tools Used

Manual Review

Recommendations

• Gas Limits and Estimates:
  Be mindful of the gas limits of transactions and use tools to estimate gas usage. This can help in designing contracts to avoid OOG errors by ensuring transactions have enough gas to complete.