Core Contracts

Summary

There's a potential vulnerability in the getTotalWeight function of the GaugeController contract. The function iterates over the _gaugeList array to calculate the total weight of all active gauges. However, there is no limit set on the size of the _gaugeList, which could lead to an Out of Gas (OOG) error if the list becomes excessively large which could then cause a DoS on distributeRewards() that depends on it.

Vulnerability Details

The GaugeController function does not impose any restrictions on the number of gauges that can be added to the _gaugeList. As a result, as the guageList grows, the function may attempt to iterate through a very large array, leading to excessive gas consumption and potentially causing the transaction to fail.

Relevant Code Snippet

Impact

The lack of a limit on the _gaugeList can lead to a situation where the getTotalWeight function consumes more gas than is available in a single transaction. This could result in failed transactions, which would prevent users from retrieving the total weight of active gauges. In a worst-case scenario, it could lead to denial of service for users trying to interact with the contract.

Tools Used

• Manual code review

Recommendations

1. Limit the Size of _gaugeList: Implement a maximum limit on the number of gauges that can be added to the _gaugeList. This can be done by introducing a cap in the addGauge function.