Mystery Box
First Flight #25
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Unbounded Loop in claimAllRewards

ezerez

Summary

The claimAllRewards function contains an unbounded loop that could potentially cause the function to run out of gas.

Vulnerability Details

The loop in claimAllRewards iterates over all rewards owned by a user:

for (uint256 i = 0; i < rewardsOwned[msg.sender].length; i++) {
totalValue += rewardsOwned[msg.sender][i].value;
}

If a user accumulates a large number of rewards, this loop could exceed the block gas limit, making it impossible to claim rewards.

Impact

Medium. Users with many rewards might be unable to claim them all at once, potentially leading to locked rewards.

Tools Used

Manual code review.

Recommendations

  • Implement a batched withdrawal system, allowing users to claim a fixed number of rewards at a time.

  • Set a maximum limit on the number of unclaimed rewards a user can accumulate.

Updates

Appeal created

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Gas Limit Exhaustion in `claimAllRewards` Function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!