Beanstalk: Dive Into Basin

Summary

The function "readTwaReserves()" in MultiFlowPump.sol contract code is susceptible to a denial-of-service (DoS) attack due to unbounded loop iterating over an array. Malicious users could abuse this vulnerability by repeatedly calling the function with a large number of items in the byteCumulativeReserves array, causing excessive gas consumption and potentially leading to a DoS scenario.

Vulnerability Details

The vulnerability arises from the for loop in the readTwaReserves function, which iterates over the byteCumulativeReserves array. As the loop does not have an upper bound check or gas optimization mechanisms, it can be exploited by malicious users to consume excessive gas, leading to denial of service. Thus, the function is public, a malicious user can call the function again and again. The lack of gas optimization and the potential for unbounded iteration make this function susceptible to abuse.

function readTwaReserves(

    address well,
    bytes calldata startCumulativeReserves,
    uint256 startTimestamp,
    bytes memory data
) public view returns (uint256[] memory twaReserves, bytes memory cumulativeReserves) {
    bytes16[] memory byteCumulativeReserves = _readCumulativeReserves(well, data);
    bytes16[] memory byteStartCumulativeReserves = abi.decode(startCumulativeReserves, (bytes16[]));
    twaReserves = new uint256[](byteCumulativeReserves.length);

    // Overflow is desired on `startTimestamp`, so SafeCast is not used.
    bytes16 deltaTimestamp = _getDeltaTimestamp(uint40(startTimestamp)).fromUInt();
    if (deltaTimestamp == bytes16(0)) {
        revert NoTimePassed();
    }
    for (uint256 i; i < byteCumulativeReserves.length; ++i) {
        // Currently, there is no support for overflow.
        twaReserves[i] =
            (byteCumulativeReserves[i].sub(byteStartCumulativeReserves[i])).div(deltaTimestamp).pow_2ToUInt();
    }
    cumulativeReserves = abi.encode(byteCumulativeReserves);
}

// Code snippet has been added seperately as GitHub link.

Impact

Potential denial-of-service (DoS) attack on the smart contract. If exploited, malicious users could cause the function readTwaReserves to consume all available gas, make it unusable. This could disrupt the normal operation of the contract, break core functionality.

Likelihood: High
Impact: Medium
Severity: Medium

Tools Used

Manual

Recommendations

• Limit the maximum number of iterations in the loop or breaking down the computation into smaller chunks.

• Implement access controls to prevent abuse of the function by malicious users.

• Consider implementing circuit breakers or emergency stop mechanisms to halt the function in case of unexpected resource consumption.