Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Unbounded Loop in `unstakeAll()` Function Causing Out-of-Gas Errors

wizard

Summary

The unstakeAll() function in the FjordStaking contract contains an unbounded loop that iterates over all user deposits. This design can lead to out-of-gas errors if a user accumulates a large number of deposits over time, resulting in DOS vulnerability.

Vulnerability Details

The unstakeAll() function iterates through all deposits of a user without any limit

function unstakeAll() external {
uint256 length = userDeposits[msg.sender].length;
for (uint256 i = 0; i < length; i++) {
Deposit storage deposit = userDeposits[msg.sender][i];
if (deposit.amount > 0) {
unstake(i);
}
}
}

this unbounded loop can consume an unpredictable amount of gas, potentially exceeding the block gas limit if the number of deposits is sufficiently large

Impact

  1. Users with many deposits may be unable to unstake their tokens due to consistently failing transactions

  2. User funds could become effectively locked in the contract if unstaking operations consistently fail du to gas limitations.

  3. Even when transactions doesn't fail, users with many deposits will face higher gas costs for unstaking operations.

Tools Used

Manual Review

Recommendations

Implementing a Batch Processing, modifying the unstakeAll() function to process a limited number of deposits per transaction

event PartialUnstaked(address indexed user, uint256 processedCount);
​
+++++Rest of the Code+++++
function unstakeAll(uint256 batchSize) external {
uint256 length = userDeposits[msg.sender].length;
uint256 endIndex = Math.min(batchSize, length);
for (uint256 i = 0; i < endIndex; i++) {
Deposit storage deposit = userDeposits[msg.sender][i];
if (deposit.amount > 0) {
unstake(i);
}
}
emit PartialUnstaked(msg.sender, endIndex);
​
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.