Zaros Part 1

Summary

The createTradingAccountAndMulticall function in the TradingAccountBranch contract allows for unlimited function calls within a single transaction, potentially enabling a Denial of Service (DoS) attack that could prevent other users from successfully calling functions like depositMargin and withdrawMargin

Vulnerability Details

The attacker could use the createTradingAccountAndMulticall function to perform a Denial of Service (DoS) attack, preventing other users from depositing margin

Example Scenario

Bob wants to deposit margin into his trading account using the depositMargin function.

Eve, a malicious attacker, wants to prevent Bob and other users from successfully depositing margin.

Eve crafts a transaction using the createTradingAccountAndMulticall function.
Eve includes a large number of depositMargin calls within the data array, each with a small amount of margin to deposit.

Eve sends this transaction with a high gas limit and sufficient Amount to cover the gas costs.

The createTradingAccountAndMulticall function starts processing Eve's transaction.

It loops through the data array, executing each depositMargin call using delegatecall.

Each delegatecall retains the original msg.value, and the gas used accumulates with each call.

Eve's transaction consumes a significant portion of the block's gas limit due to the large number of delegatecall operations.

The network becomes congested as miners prioritize high-gas transactions like Eve's.

Bob tries to deposit margin using the depositMargin function.

Due to network congestion caused by Eve's transaction, Bob's transaction faces delays and higher gas fees.

If Bob's transaction is included in a block, it might be reverted due to insufficient gas or other issues caused by the congestion.

Impact

Network Congestion: An attacker could create a transaction with numerous depositMargin calls, consuming significant gas and congesting the network.

Blocked Transactions: Other users' attempts to call depositMargin might be blocked or reverted due to congestion or high gas prices.

Increased Costs: Gas prices could spike, making it more expensive for legitimate users to interact with the contract.

Delayed Execution: Users' transactions might be significantly delayed, problematic in fast-moving markets.

NOTE:- Both withdrawMargin and createAccount are also affected by this issue.

Tools Used

Manual Review

Recommendations

Implement a maximum limit on the number of function calls that can be made in a single createTradingAccountAndMulticall transaction.