Submission Details
Severity:
Denial of Service via Mass Scheduling
Summary
Currently there is no restriction on the number of operations that can be scheduled in a single batch:
address[] calldata targets,
uint256[] calldata values,
bytes[] calldata calldatas,
bytes32 predecessor,
bytes32 salt,
uint256 delay
) external override onlyRole(PROPOSER_ROLE) returns (bytes32) {
// Input validation: check if the number of targets, values, and calldatas are the same
if (targets.length == 0 || targets.length != values.length || targets.length != calldatas.length) {
revert InvalidTargetCount();
}
Same goes to executeBatch() function and other related functions
A proposer can schedule thousands of operations in a single transaction
This bloats storage with _operations increases gas costs, and can lead to contract execution failure due to out of gas error
Impact
Gas error
DoS
Tools Used
Manual Review
Recommendations
Add a check for tagets.length
require(targets.length <= 100, "Batch size too large");
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.