BattleChain Confidence Pools
Cyfrin
FoundrySolidityLayer 2
7.25 ETH
View all submissions
Previous Next
Submission Details
Impact: low
Likelihood: low

Unbounded loop in _replaceScope can cause out-of-gas (DoS) during scope updates

Author Revealed upon completion

Root + Impact

Description

  • The internal _replaceScope function clears the existing scope and provisions the new one using two "for" loops that iterate over "old.length" and "accounts.length". Supplying an exceptionally large array of accounts can cause the transaction to exceed the block gas limit.

function _replaceScope(address[] calldata accounts) internal {
if (accounts.length == 0) revert EmptyScope();
​
​
// Clear existing scope first so this is a wholesale replacement.
address[] memory old = _scopeAccounts;
// aderyn-fp-next-line(costly-loop) aderyn-fp-next-line(uninitialized-local-variable)
for (uint256 i; i < old.length; ++i) { //@audit looping over old
isAccountInScope[old[i]] = false;
}
delete _scopeAccounts;
​
​
// Apply the new scope and validate against the agreement. The revert-on-invalid-account
// is intentional: scope-setting must be atomic, so a single out-of-agreement account
// rejects the whole call rather than being silently skipped.
// aderyn-fp-next-line(costly-loop) aderyn-fp-next-line(require-revert-in-loop) aderyn-fp-next-line(uninitialized-local-variable)
for (uint256 i; i < accounts.length; ++i) { //@audit looping
address account = accounts[i];
if (isAccountInScope[account]) revert DuplicateAccount(account);
// aderyn-fp-next-line(reentrancy-state-change)
if (!IAgreement(agreement).isContractInScope(account)) {
revert AccountNotInAgreementScope(account);
}
_scopeAccounts.push(account);
isAccountInScope[account] = true;
}
​
​
emit ScopeUpdated(accounts);
}

Risk

Impact:

  • If a sponsor creates a pool with an extremely large initial scope, they could permanently lock themselves out of updating the scope via "setPoolScope", as the transaction to clear the old scope would continuously revert with an out-of-gas error.

​

Recommended Mitigation

Consider having a reasonable upper bound for the accounts array length.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!