Venus Prime - 0xblackskull's results

Lines of code

https://github.com/code-423n4/2023-09-venus/blob/main/contracts/Tokens/Prime/Prime.sol#L200-L230

Vulnerability details

Impact

This will persistently cause DOS on updateScores() function. Depending on how big the deficiency is.

Proof of Concept

After writing test case in foundry is show continuously

[⠰] Compiling...
No files changed, compilation skipped

Because continue comes before ++i, this non-incremented iteration is repeatedly executed till gas is run out, after refactored the code (you can see in Recommended Mitigation Steps code) it work perfectly.

Here is another example https://github.com/sherlock-audit/2023-02-olympus-judging/issues/125

Tools Used

Code review and solodit

Recommended Mitigation Steps

Consider having the affected code logic refactored as follows:

-       for (uint256 i = 0; i < users.length; ) {
+       for (uint256 i = 0; i < users.length; ++i) {
            address user = users[i];

            if (!tokens[user].exists) revert UserHasNoPrimeToken();
            if (isScoreUpdated[nextScoreUpdateRoundId][user]) continue;

            address[] storage _allMarkets = allMarkets;
            for (uint256 j = 0; j < _allMarkets.length; ) {
                address market = _allMarkets[j];
                _executeBoost(user, market);
                _updateScore(user, market);

                unchecked {
                    j++;
                }
            }

            pendingScoreUpdates--;
            isScoreUpdated[nextScoreUpdateRoundId][user] = true;

-            unchecked {
-                i++;
-            }

            emit UserScoreUpdated(user);
        }

Assessed type

Context