Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

`LendingPool::getUserCollateralValue()` Potential DoS due to Loop on unbound array.

singularity0x00

Summary

LendingPool::getUserCollateralValue() runs a for loop on a mapping userData to get all the NFTs owned by the user. when this will be called for a user with large number of tokens it will lead to DoS. And user will have to reduce their tokens to accesss other features in the protocol since this function is also called by other functions such as borrow() , withdrawNFT().

Vulnerability Details

LendingPool::getUserCollateralValue() runs a for loop on a mapping userData to get all the NFTs owned by the user, If user owns a huge amount of tokens calling this function with that user's address as parameter can lead to Dos.
The only way to then stop this would be when the user send their NFTs to other addresses As there is no direct way for a protocol Admin to burn/transfer User's tokens.

function getUserCollateralValue(address userAddress) public view returns (uint256) {
UserData storage user = userData[userAddress];
uint256 totalValue = 0;
​
//@audit loop on unbound array
for (uint256 i = 0; i < user.nftTokenIds.length; i++) {
uint256 tokenId = user.nftTokenIds[i];
uint256 price = getNFTPrice(tokenId);
totalValue += price;
}
​
return totalValue;
}

Impact

  • DoS

  • Bad User Experience

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

LendingPool: Unbounded NFT array iteration in collateral valuation functions creates DoS risk, potentially blocking liquidations and critical operations

LightChaser L-36 and M-02 covers it.

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

LendingPool: Unbounded NFT array iteration in collateral valuation functions creates DoS risk, potentially blocking liquidations and critical operations

LightChaser L-36 and M-02 covers it.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!