Platform: Code4rena
Start Date: 21/12/2021
Pot Size: $30,000 USDC
Total HM: 20
Participants: 20
Period: 5 days
Judge: Jack the Pug
Total Solo HM: 13
Id: 70
League: ETH
Rank: 19/20
Findings: 1
Award: $26.21
🌟 Selected for report: 0
🚀 Solo Findings: 0
26.2062 USDC - $26.21
jayjonah8
In LiquidityBasedTWAP.sol the vaderPairs storage variable is an array and this array is looped over in the getStaleVaderPrice() function. Looping dynamic arrays without limits can cause out of gas errors as the number of pairs grows and could lead to the function breaking every time.
https://blog.b9lab.com/getting-loopy-with-solidity-1d51794622ad
https://github.com/code-423n4/2021-12-vader/blob/main/contracts/lbt/LiquidityBasedTWAP.sol#L27
https://github.com/code-423n4/2021-12-vader/blob/main/contracts/lbt/LiquidityBasedTWAP.sol#L56
Manual code review
There should be a limit set for the vaderPairs array that can be updated by an admin to avoid scaling problems due to looping large arrays and reaching the gas limit.
#0 - jack-the-pug
2022-03-13T07:04:12Z
Dup #110