Project

Summary

The burnBatchMultiple function in MembershipERC1155 contract contains the unbounded double loop that iterates through an array of addresses. If this array is too large, the function could exceed the block gas limit, causing a denial of service condition.

Vulnerability Details

The vulnerability exists in the burnBatchMultiple function:

Key issues:
The outer loop iterates through an unbounded array froms
Each iteration requires 7 inner loop iterations
Each burn_ operation consumes significant gas
No limit on the size of froms array

Impact

Transaction Failure: If froms.length is too large, the transaction will fail due to exceeding block gas limit
Denial of Service: Function becomes unusable when array size is too large
Gas Waste: Failed transactions still consume gas
Function Unusability: Critical batch operations could become impossible to execute
Admin Function Blocking: Since this is an admin function (OWP_FACTORY_ROLE), it could block important protocol operations

Tools Used

Manual code review

Recommendations

1.Add Array Length Limit:
2.Implement Pagination