Root + Impact

Description

• Users deposit assets before they join an event, this asset is stored as 'stakedAssets' and when the user tries to join an event, this staked asset is checked to ensure that the user has deposited before the user's address is stored in the dynamic array 'usersAddress'

• The problem here is that the array is unbounded, can grow indefinetly, so an attacker can fill the array with thousands of different addresses, or same address multiple times, so when owner goes to call the 'setWinner' function to set the winning country, the function '_getWinnerShares' is called internally within the function, this function iterates over the 'usersAddress' array, the function will hit the block gas limit and revert, meaning owner can't set a winner

Risk

Likelihood:

• If owner goes to set the winning team after attacker has filled the array past the gas limit threshold of a block

Impact:

• Direct DOS leading to stuck funds in the protocol, since owner can't set a winning country, nobody can claim funds

Proof of Concept

Recommended Mitigation