Submission Details
Severity:
`MartenitsaEvent::participants` is an unbounded array which could cause the `stopEvent` function to revert due to reaching the block gas limit.
Summary
The MartenitsaEvent::stopEvent is intended to stop the event and remove the producer
role from the participants.
Inside its definition, the stopEvent function loops over the participants array which is not bounded.
This could result in the gas consumed by the stopEvent function to exceed the gas block limit and thus
reverting the transaction.
Vulnerability Details
function stopEvent() external onlyOwner {
require(block.timestamp >= eventEndTime, "Event is not ended");
// @-audit the loop below is unbounded and therefore the gas consumed is not limited
for (uint256 i = 0; i < participants.length; i++) {
isProducer[participants[i]] = false;
}
}
Impact
The event cannot be stopped and the producer role cannot be removed from the participants.
Tools Used
Manual review.
Recommended Mitigation
Consider running the logic inside the stopEvent function in batches to make sure
the gas consumed is limited.
Updates
Lead Judging Commences
bube over 1 year ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
Unbounded arrays
Rewards breakdown
nSLOC
239This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.