Summary

Vulnerability Details

The _verify_proof function uses a loop to iterate over the Merkle proof and compute the hash, as seen below:

As the number of users and proof elements increases, this could lead to increased gas costs for verification, potentially making the contract inefficient and unaffordable for large-scale usage.

Impact

Tools Used

Recommendations

Consider optimizing the Merkle proof verification process, such as limiting the maximum number of proof elements that can be processed in a single transaction. Alternatively, the contract can use an off-chain service to handle Merkle proof verification and reduce on-chain computations.