Zaros Part 1
Zaros
DeFiFoundry
60,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Lack of Validation for Length of the data Array in createTradingAccountAndMulticall Function

TZARred

Relevant GitHub Links

https://github.com/Cyfrin/2024-07-zaros/blob/main/src/perpetuals/branches/TradingAccountBranch.sol#L285-L311

Summary

The createTradingAccountAndMulticall function allows users to create a new trading account and execute multiple calls in a single transaction. However, it does not validate the length of the calldata array data, which can potentially lead to excessive gas consumption or denial-of-service (DoS) attacks.

Vulnerability Details

Lack of validation for the length of the data array. An attacker can provide a very large data array, causing the transaction to consume excessive gas or fail due to block gas limit, potentially leading to DoS.

Impact

Gas Consumption: An attacker can craft a transaction with a very large data array, causing the contract to consume a significant amount of gas.
Denial-of-Service (DoS): The function may fail due to block gas limit constraints if the data array is excessively large, potentially preventing legitimate users from interacting with the contract.

Tools Used

Manual

Recommendations

Validate the length of the data array to ensure it is within a reasonable limit before processing the multicall. This will prevent excessive gas consumption and mitigate the risk of DoS attacks.

function createTradingAccountAndMulticall(
bytes[] calldata data,
bytes memory referralCode,
bool isCustomReferralCode
)
external
payable
virtual
returns (bytes[] memory results)
{
+ uint256 maxDataLength = 100; // Set an appropriate limit based on your use case
+ require(data.length <= maxDataLength, "Data array length exceeds limit");
​
uint128 tradingAccountId = createTradingAccount(referralCode, isCustomReferralCode);
​
results = new bytes[](data.length);
for (uint256 i; i < data.length; i++) {
bytes memory dataWithAccountId = bytes.concat(data[i][0:4], abi.encode(tradingAccountId), data[i][4:]);
(bool success, bytes memory result) = address(this).delegatecall(dataWithAccountId);
​
if (!success) {
uint256 len = result.length;
assembly {
revert(add(result, 0x20), len)
}
}
​
results[i] = result;
}
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.