length of poolsFeeData can by bypassed
Summary
When user add liquidity length of the poolsFeeData array can't exceed 100 to mitigate DDOS issus but this check is forgotten in afterUpdate
scenario
bob has already 100 deposits
an update happens many times
bob array length keeps getting bigger with no restriction of 100
Vulnerability Details
Impact
leads to DDOS attacks (which the protocol is trying to mitigate)
out of gas issues causing user funds to get stuck
Tools Used
manual review
Recommendations
in afterUpdate function add this check
Lead Judging Commences
finding_afterUpdate_does_not_check_limit_NFT_per_user
Likelihood: Medium/High, anyone can receive an unlimited NFT number but will cost creation of LP tokens and sending them. Impact: Low/Medium, DoS the afterUpdate and addLiquidityProportional but will be mitigable on-chain because a lot of those NFT can be burn easily in onAfterRemoveLiquidity.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.