Olympus DAO contest - Chom's results

Lines of code

https://github.com/code-423n4/2022-08-olympus/blob/b5e139d732eb4c07102f149fb9426d356af617aa/src/Kernel.sol#L351-L372

Vulnerability details

Impact

Kernel may not be able to migrate due to having too many keycodes or policies. Having too many keycodes or policies will raise the gas limit revert on _migrateKernel function.

Proof of Concept

    function _migrateKernel(Kernel newKernel_) internal {
        uint256 keycodeLen = allKeycodes.length;
        for (uint256 i; i < keycodeLen; ) {
            Module module = Module(getModuleForKeycode[allKeycodes[i]]);
            module.changeKernel(newKernel_);
            unchecked {
                ++i;
            }
        }

        uint256 policiesLen = activePolicies.length;
        for (uint256 j; j < policiesLen; ) {
            Policy policy = activePolicies[j];

            // Deactivate before changing kernel
            policy.setActiveStatus(false);
            policy.changeKernel(newKernel_);
            unchecked {
                ++j;
            }
        }
    }

Since it loop with allKeycodes and activePolicies. If either allKeycodes or activePolicies has too many members. Gas will explode.

Tools Used

Manual review

Recommended Mitigation Steps

limit number of allKeycodes and activePolicies