Venus Prime - ADM's results

Lines of code

https://github.com/code-423n4/2023-09-venus/blob/edc2212c77c8a419bd49a05ec1e2556405095922/contracts/Tokens/Prime/Prime.sol#L204-L226

Vulnerability details

Impact

Prime.sol#updateScores can be stuck in an infinite loop due to the increment occurring after the continue statement.

Proof of Concept

If updateScores is called with a users array where any of the users return true for isScoreUpdated[nextScoreUpdateRoundId][user] then the next iteration will be triggered without incrementing i. As this will just fetch the same user again the loop will continue until all gas has been consumed and cause the function to revert.

Tools Used

Manual Review

Recommended Mitigation Steps

Move the increment to line 206, so it is after setting the user variable but before running the check that can trigger the continue statement.

address user = users[i];
unchecked {
    i++;
}
if (!tokens[user].exists) revert UserHasNoPrimeToken();
if (isScoreUpdated[nextScoreUpdateRoundId][user]) continue;

Assessed type

Loop