Zaros Part 1

Summary

liquidateAccounts will revert due to reaching gas limit for even a few accounts due to double for loop usage

Vulnerability Details

liquidateAccounts takes in a list of accountsIds to liquidate. The issue is that it uses nested for loops.

The first one is to iterate over each account.

The second one is for each account to iterate over every single activeMarket.

When trying to liquidate 10 accounts, that each have 10 active markets, the loop will iterate 100 times!

From my testing 1 iteration takes 400k gas, therefore 100 iterations will take 40M gas that is > 32M gas the block gas limit on arbitrum, hence it will revert

Impact

Liquidations may revert and hence are delayed. This can cause major losses for the protocol in volatile price scenarios

Tools Used

Manual Review and foundry testing

Recommendations

Do not use nested loops for critical time sensitive functions