Zaros Part 1

Relevant GitHub Links

https://github.com/Cyfrin/2024-07-zaros/blob/main/src/perpetuals/branches/LiquidationBranch.sol#L105-L223

Summary

Processing multiple accounts in liquidateAccounts can exceed the gas limit, causing transactions to revert.

Vulnerability Details

The function liquidateAccounts does not have a mechanism to limit the number of accounts processed in a single transaction. If the number of accounts is too large, the transaction can exceed the gas limit and revert, leading to potential denial of service.

Impact

Transaction Reversion: Exceeding the gas limit causes the transaction to revert.

Denial of Service: Legitimate liquidation operations might be delayed or prevented due to reverted transactions.

Tools Used

Manual

Recommendations

Limit Account Processing: Implement a mechanism to limit the number of accounts processed in a single transaction.

Break Tasks into Smaller Chunks: Split the liquidation process into multiple smaller transactions to stay within gas limits.