Summary

Vulnerability Details

Lines of impacted code:

• https://github.com/Cyfrin/2024-09-stakelink/blob/main/contracts/core/priorityPool/WithdrawalPool.sol#L56

• https://github.com/Cyfrin/2024-09-stakelink/blob/main/contracts/core/priorityPool/WithdrawalPool.sol#L447

• https://github.com/Cyfrin/2024-09-stakelink/blob/main/contracts/core/priorityPool/WithdrawalPool.sol#L453

WithdrawalBatch[] internal withdrawalBatches; is a dynamic array which only grows during the lifetime of withdrawal pool contract. At this moment there is no way to remove items from this list. If grown in significant size it might be difficult to traverse through or retrieve items from this list. It might break multiple private/public functions including updateWithdrawalBatchIdCutoff.

Impact

Continuously growing withdrawalBatches might break WithdrawalPool contract.

Tools Used

Recommendations

Have a mechanism to put a hard cap on withdrawalBatches and delete items from withdrawalBatches.