Dria

Summary

• The purchase() function logic currently does not attempt to maximize asset purchases within the spending limit.

Vulnerability Details

• In the purchase() function, assets are purchased in the order they are returned by the oracle without any sorting by price. If a high-priced asset appears early in the list, it can quickly cause spendings[round] to exceed amountPerRound, resulting in a revert.

• This behavior can prevent other assets, which might be within budget, from being purchased. Thus, a high-priced asset early in the list can effectively deny service, causing repeated transaction failures even when other affordable assets are present.

Impact

• Denial of Service (DoS): The current implementation is susceptible to a denial-of-service-like behavior where a high-priced asset can block the purchase of other assets that are within budget.

• Increased Gas Costs: Users may face increased gas costs due to repeated failed transactions when high-priced assets cause the spending limit to be exceeded.

Tools Used

• Manual code review

Recommendations

• Skip Expensive Assets: Can try to skip assets that would exceed spending limit and try to purchase other assets, this will allow maximising asset purchases without reverts.

• Can Sort assets by price : This would maximise the number of assets that can be purchased within the amountPerRound limit.