Liquidity Management

Details:
The getUserDeposits function iterates over a user's deposit set without any bounds or pagination. If a user accumulates a large number of deposits, the loop may consume excessive gas when the function is called. In extreme cases, this could cause the function call to exceed the block gas limit and revert, effectively limiting the number of deposits a user can have.

Root Cause:
The function uses an unbounded loop to iterate over the EnumerableSet of user deposits. There is no mechanism to paginate or restrict the number of items processed in a single call.

Impact:

• Denial of Service (DoS): Users with a large number of deposits may be unable to retrieve their deposit data because the call could run out of gas.

• Limited Deposit Capability: This issue indirectly limits the number of deposits a user can create, as exceeding a certain number will render the retrieval function unusable.

• Operational Disruption: Functions or off-chain services that rely on getUserDeposits for processing deposit data might face reliability issues if the gas cost becomes too high.

Recommendation:

• Implement Pagination: Modify the function to support pagination so that only a subset of deposits is returned per call.

• Limit Return Size: Introduce a maximum limit on the number of deposits that can be returned in one call, with the possibility to request additional pages.

• Off-Chain Indexing: Consider using off-chain indexing services to manage and retrieve deposit data for users with many deposits.

Proof of Concept:

1. A user creates a very large number of deposits (e.g., thousands).

2. When calling getUserDeposits, the function enters a loop iterating over every deposit.

3. Due to the high number of iterations, the call consumes more gas than the block limit allows, causing the call to revert.

4. This demonstrates that excessive deposits can prevent successful retrieval of user deposit data.

By implementing pagination or limiting the number of items returned per call, the contract can mitigate this potential gas exhaustion issue.