Core Contracts

Summary:

FILE:GaugeController.sol

CODE:

The function getActiveGauges() iterates over _gaugeList.length, which may change dynamically, leading to unbounded iteration, gas exhaustion, or incorrect calculations. Caching _gaugeList.length before looping prevents these issues.

Vulnerability Details

The function getActiveGauges() iterates over _gaugeList.length, but if _gaugeList is modified dynamically, it can lead to:

• Unbounded Iteration: If _gaugeList grows continuously, the loop may never terminate.

• Gas Overflow Risk: Large iterations may cause the transaction to run out of gas.

• Unexpected State Changes: If _gaugeList.length changes mid-iteration, it could result in incorrect computations.

Impact

A malicious actor or unexpected contract behavior could cause excessive gas consumption, breaking contract execution or leading to denial-of-service (DoS).

##Proof of Concept (PoC)

1. Assume _gaugeList is dynamically updated while iterating.

2. If a function call triggers an update to _gaugeList, its length may increase.

3. The loop may iterate indefinitely or consume excessive gas, failing execution.

Tools Used

NONE

Recommendations

Cache _gaugeList.length at the beginning of the loop to prevent dynamic changes affecting iteration.

• Implement gas constraints to limit excessive iterations in a single transaction.

• Use a mapping-based storage structure instead of iterating over a dynamic array when possible.