Zaros Part 1

Summary

collateralLiqudationPriority and activeMarketIds are EnumerableSets. During state modification, the values function is called for both sets, which copies all set values to memory.

Vulnerability Details

The issue arises if one of these sets grows large enough to cause a Denial of Service (DoS). The inline documentation for the values() function states:

Additionally, both functions that use these set values perform numerous operations, increasing the likelihood of a DoS.

Impact

The protocol will become unusable as it will be impossible to remove a collateral priority from the list and liquidate some accounts.

Tools Used

Manual review

Recommendations

Implement a size limitation for both sets to prevent a DoS scenario.