Summary

The StrategyMainnet contract's addRoute function allows unlimited addition of routes without any maximum limit. While not a critical issue, implementing a reasonable upper bound would improve gas efficiency and follow best practices.

Vulnerability Details

Each route stores significant data:

• 11 addresses for route (220 bytes)

• 25 uint256s for swap params (800 bytes)

• 5 addresses for pools (100 bytes)
  Total: ~1120 bytes per route

Impact

1. While not a DOS concern (even 50 routes wouldn't approach block gas limits), unnecessary routes increase gas costs for:

   • Storage costs when adding routes

   • Slightly higher gas when accessing route data in claimAndSwap

2. No cleanup mechanism for outdated routes

Recommendation

Add a reasonable maximum route limit based on expected usage:

The limit of 10 routes should be more than sufficient for managing different Curve pool routes while maintaining gas efficiency.