Submission Details
Severity:
Possible Dos attack for MartenitsaEvent::stopEvent()
Summary
Possible Dos attack when there're lots of participants.
Vulnerability Details
In MartenitsaEvent, when the owner calls stopEvent() to stop one event. Contracts will loop all participants to reset variable isProducer.
function stopEvent() external onlyOwner {
require(block.timestamp >= eventEndTime, "Event is not ended");
for (uint256 i = 0; i < participants.length; i++) {
isProducer[participants[i]] = false;
}
}
If there're lots of participants, the event might not be ended because of out of gas.
Impact
These participants will gain permanent producer permission, this is unexpected.
Tools Used
Manual
Recommendations
Consider to limit the number of participant to avoid this kind of scenario.
Updates
Lead Judging Commences
bube about 1 year ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
Unbounded arrays
Rewards breakdown
nSLOC
239This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.