Venus Prime - SBSecurity's results

Judge has assessed an item in Issue #659 as 2 risk. The relevant finding follows:

[L-01] updateScores will result in DoS if pass a user with an already updated score Impact If updateScores is called for a user who is already updated in the same round, the function will misbehave, causing it to repeat lines 205-208 until the gas limit is reached.

200: function updateScores(address[] memory users) external { if (pendingScoreUpdates == 0) revert NoScoreUpdatesRequired(); if (nextScoreUpdateRoundId == 0) revert NoScoreUpdatesRequired();

    for (uint256 i = 0; i < users.length; ) {

205: address user = users[i]; 206: 207: if (!tokens[user].exists) revert UserHasNoPrimeToken(); //@audit in case user who has his score updated is passed to the array i will not be incremented which will lead to the waste of gas when function is called 208: if (isScoreUpdated[nextScoreUpdateRoundId][user]) continue;

        address[] storage _allMarkets = allMarkets;
        for (uint256 j = 0; j < _allMarkets.length; ) {
            address market = _allMarkets[j];
            _executeBoost(user, market);
            _updateScore(user, market);

            unchecked {
                j++;
            }
        }

        pendingScoreUpdates--;
        isScoreUpdated[nextScoreUpdateRoundId][user] = true;

        unchecked {
            i++;
        }

        emit UserScoreUpdated(user);
    }
}

https://github.com/code-423n4/2023-09-venus/blob/b11d9ef9db8237678567e66759003138f2368d23/contracts/Tokens/Prime/Prime.sol#L208