Liquid Staking

Summary

Due to the unbounded loop
for (uint256 i = 0; i < splittersToCall.length; ++i) { (bool upkeepNeeded, ) = splitters[accounts[i]].checkUpkeep(""); splittersToCall[i] = upkeepNeeded; if (upkeepNeeded) overallUpkeepNeeded = true; }
and the potential for as many accounts to be added as desired, there is potential for a denial of service where there isn't enough gas in a block to complete a transaction once the number of accounts reaches a critical number.

Vulnerability Details

checkUpkeep fails to work due to too many accounts being in the system so rewards can not be distributed in the system. So, rewards are not able to be split between fee receivers.

Impact

The impact is medium but the likelihood is low because the owner could just call LSTRewardsSplitterController::removeSplitter if the length of the array gets excessively large.

Tools Used

Manual

Recommendations

Potentially set a limit to the array's size to ensure it can't get excessively large.