Canto Dex Oracle contest - m_Rassska's results

Lines of code

https://github.com/code-423n4/2022-09-canto/blob/65fbb8b9de22cf8f8f3d742b38b4be41ee35c468/src/Swap/BaseV1-core.sol#L560-L568

Vulnerability details

[M-01] Unbounded gas consumption

Description:

• In BaseV1Factory, there is a function setPeriodSize(uint256) which sets the newPeriodSize for pair. However, the pairs length is not under a limit, thus it causes unbounded gas consumption and from some point it may exceed the hard limits.

All occurances:

• Contracts:

      function setPeriodSize(uint newPeriod) external {
          require(msg.sender == admin);
          require(newPeriod <= MaxPeriod);
  
          for (uint i; i < allPairs.length; ) {
              BaseV1Pair(allPairs[i]).setPeriodSize(newPeriod);
              unchecked {++i;}
          }
      }

Recommended Mitigation Steps :

• It's a good practice to devide it into bunch of batches in order to setPeriodSize in multiple transactions.