Summary

The batchCreateContingentPool function is vulnerable to a Denial of Service (DoS) attack through gas exhaustion due to unbounded array processing, potentially preventing users from creating pools if an attacker submits a transaction with an excessively large array.

Vulnerability Details

The batchCreateContingentPool function processes an array of PoolParams without imposing any limit on the array size. This design allows an attacker to submit a transaction with an extremely large array of pool parameters, causing the transaction to consume more gas than the block gas limit allows. When this happens, the transaction will fail, and no pools can be created through this function.

Impacted code:

Impact

I've rated this as MEDIUM because it doesn't result in direct loss of funds, the core functionality (creating individual pools) remains accessible through non-batch functions, and it primarily affects gas efficiency and convenience rather than security. However, the attack is relatively simple to execute, it requires minimal resources from the attacker, and the function is publicly accessible. Despite gas limits being a well-known constraint, there are no existing controls to prevent the attack.

For example:

Recommendations

Implement a maximum limit on the number of pools that can be created in a single batch transaction. This can be done by adding a constant and a check at the beginning of the function:

Here the maximum batch size can be processed within block gas limits under worst-case conditions.