Lack of Input Validation
Summary
In depositTokens, inputs like ids array length aren't validated, potentially allowing excessive gas consumption or logic bypasses (e.g., checking ids.length).
Vulnerability Details
The contract handles potentially large arrays of token IDs, especially in the depositTokens and withdrawTokens functions. If these arrays are too large, it could lead to out-of-gas errors, making the operations fail.
Impact
Tools Used
Recommendations
Lead Judging Commences
Informational / Gas
Please, do not suppose impacts, think about the real impact of the bug and check the CodeHawks documentation to confirm: https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity A PoC always helps to understand the real impact possible.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.