Core Contracts

Summary

Unbounded loops in GaugeController.sol create a Denial of Service (DoS) risk, as excessive gas costs can halt execution.

Vulnerability Details

• The functions distributeRevenue() and calculateGaugeWeight() iterate over _gaugeList.length without any size limit.

• If _gaugeList grows too large, the gas cost may exceed the block limit, permanently bricking these functions.

• Since distributeRevenue() controls revenue distribution to liquidity gauges, a DoS attack could freeze gauge rewards.

PoC

GaugeController.sol contains unbounded loops that attackers can exploit to create Denial of Service (DoS).

Exploit Scenario

• The attacker adds a large number of gauges to _gaugeList[].

• Calls distributeRevenue(), which fails due to excessive gas use.

• Revenue distribution is halted for all users.

PoC Exploit

Expected Outcome

• Protocol halts due to excessive gas costs.

• Liquidity providers stop receiving revenue.

• Governance functions become inoperable.

Impact

• Locked protocol funds: Revenue cannot be distributed to liquidity providers.

• Protocol halt: Governance functions requiring gauge weight calculations become unusable.

• Bricking risk: A large _gaugeList can make functions fail permanently.

Tools Used

• Slither for loop complexity analysis

• Manual Review of GaugeController.sol

Recommendations

• Implement batch processing to break large loops into multiple transactions.

• Limit _gaugeList size or optimize data structures for efficiency.

• Use gas-efficient data access patterns like mapping lookups instead of full iteration.