Moonwell
Moonwell
DeFiFoundry
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Possible DoS in mipm17::_build() due to OOG

tigerfrake

Summary

The potential for Denial of Service (DoS) vulnerabilities in the _build() function primarily arises from the use of two for-loops to iterate over arrays of debtors (mFRAXDebtors and mxcDOTDebtors) and the subsequent execution of actions based on the conditions within these loops.

Vulnerability Details

At first, the function iterates over mFRAXDebtors which involves an external function call to _pushAction():

  • https://github.com/Cyfrin/2024-03-Moonwell/blob/e57b8551a92824d35d4490f5e7f27c373be172bd/src/proposals/mips/mip-m17/mip-m17.sol#L101-L120

for (uint256 i = 0; i < mFRAXDebtors.length; i++) {
if (
mFRAXDelegator.borrowBalanceStored(mFRAXDebtors[i].addr) > 0
) {
_pushAction(
mFRAXAddress,
abi.encodeWithSignature(
"fixUser(address,address)",
reallocationMultisig,
mFRAXDebtors[i].addr
),
string(
abi.encodePacked(
"Liquidate bad mFRAX debt for user: ",
Strings.toHexString(mFRAXDebtors[i].addr)
)
)
);
}
}

Then over mxcDOTDebtors which also involves an external function call to _pushAction():

  • https://github.com/Cyfrin/2024-03-Moonwell/blob/e57b8551a92824d35d4490f5e7f27c373be172bd/src/proposals/mips/mip-m17/mip-m17.sol#L138-L158

for (uint256 i = 0; i < mxcDOTDebtors.length; i++) {
if (
mxcDOTDelegator.borrowBalanceStored(mxcDOTDebtors[i].addr) >
0
) {
_pushAction(
mxcDOTAddress,
abi.encodeWithSignature(
"fixUser(address,address)",
reallocationMultisig,
mxcDOTDebtors[i].addr
),
string(
abi.encodePacked(
"Liquidate bad mxcDOT debt for user ",
Strings.toHexString(mxcDOTDebtors[i].addr)
)
)
);
}
}

Iteration over these arrays while performing the external calls to _pushAction() could consume a significant amount of gas, potentially leading to an Out of Gas (OOG) error if the transaction does not have enough gas to complete.

Impact

There is a potential for Denial of Service (DoS) vulnerabilities due to OOG

Tools Used

Manual Review

Recommendations

  • Gas Limits and Estimates:
    Be mindful of the gas limits of transactions and use tools to estimate gas usage. This can help in designing contracts to avoid OOG errors by ensuring transactions have enough gas to complete.

Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Lack of quality

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.