Hubble contest - bw's results

Lines of code

https://github.com/code-423n4/2022-02-hubble/blob/main/contracts/ClearingHouse.sol#L129 https://github.com/code-423n4/2022-02-hubble/blob/main/contracts/AMM.sol#L678

Vulnerability details

Impact

As the number of supported markets grow, settleFunding will reach a point were it exceeds the block gas limit on Avalanche C-Chain. This will prevent users from calling the function and cause a wide spread Denial of Service.

Looking at transactions for the current testnet deployment, settleFunding already reaches almost 10% of the block gas limit. This is due settle funding iteratively looping through each market, with each iteration entering an unbounded while loop in _calcTwap. The more active the markets are, the more gas intensive _calcTwap becomes, as more snapshots need to be traversed.

The combination of more active markets and an increase in available markets make it very likely that some users will be unable to call settleFunding in the long run.

Proof of Concept

Example of transactions on testnet:

Recommended Mitigation Steps

Users should be allowed to settle funding per market or using an array of markets opposed to all markets at once.

function settleFundingForMarkets(IAMM[] markets) override external whenNotPaused {
     for (uint i = 0; i < markets.length; i++) {
          markets[i].settleFunding();
     }
}

In this way the gas cost will not increase with the number of markets created over time.