Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Unbounded array in ```TokenManager::updateTokenWhiteListed``` prevent to update the Token WhiteList

kiteweb3

Summary

The TokenManager::updateTokenWhiteListed is designed to update the whitelist status of a dynamic list of ERC20 tokens. This function accepts an array of token addresses and a boolean indicating whether these tokens should be added to or removed from the whitelist. Due to the nature of blockchain transactions and the inherent gas costs associated with state changes, processing a large number of tokens in a single transaction may lead to issues related to the block gas limit.

Link: https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/TokenManager.sol#L197

Vulnerability Details

The TokenManager::updateTokenWhiteListed function iterates over an unbounded array of token addresses, performing state-changing operations for each token. If the array is sufficiently large, the total gas required to execute the function could exceed the block gas limit, causing the transaction to fail.

function updateTokenWhiteListed(
address[] calldata _tokens,
bool _isWhiteListed
) external onlyOwner {
uint256 _tokensLength = _tokens.length;
​
@> for (uint256 i = 0; i < _tokensLength; ) {
_updateTokenWhiteListed(_tokens[i], _isWhiteListed);
unchecked {
++i;
}
}
}

Impact

This vulnerability can prevent the successful execution of transactions intended to update the whitelist status of a large number of tokens at once.

Tools Used

Manual review

Recommendations

Introduce a mechanism to limit the number of tokens that can be updated in a single transaction.

Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

[invalid] finding-Admin-Errors-Malicious

The following issues and its duplicates are invalid as admin errors/input validation/malicious intents are1 generally considered invalid based on [codehawks guidelines](https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity#findings-that-may-be-invalid). If they deploy/set inputs of the contracts appropriately, there will be no issue. Additionally admins are trusted as noted in READ.ME they can break certain assumption of the code based on their actions, and

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.