60,000 USDC
Submission Details
Severity:
Unlimited memory can be consumed in uint256ArrayDeserialize, cairoStringArrayDeserialize of Cairo library
Hello ArkProject,
uint256ArrayDeserialize, cairoStringArrayDeserialize has following code. The code uses new to allocate dynamic memory arrays (new uint256[](...)). If these allocations are large and not controlled, they could be exploited to consume all available gas or even trigger out-of-gas errors, leading to denial-of-service.
uint256 len = buf[offset++];
uint256[] memory uints = new uint256[](len);
uint256 _offset = offset;
uint256 len = buf[_offset++];
string[] memory strs = new string[](len);
Prize pool breakdown
Total prize
60,000 USDC
nSLOC
2,30126 USDC / LOC
50,000 USDC
5,500 USDC
4,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.