Cudos contest - orion's results

Unbounded iteration / Gas Drainage, block stuffing, Griefing attacks :

The gravity contract : https://github.com/code-423n4/2022-05-cudos/blob/main/solidity/contracts/Gravity.sol

Have a function "testCheckValidatorSignatures" that checks the validity of signatures of multiple signatures with the address on batch mode with no limitation,

	function testCheckValidatorSignatures(
		address[] memory _currentValidators,
		uint256[] memory _currentPowers,
		uint8[] memory _v,
		bytes32[] memory _r,
		bytes32[] memory _s,
		bytes32 _theHash,
		uint256 _powerThreshold
	) public pure {
		checkValidatorSignatures(
			_currentValidators,
			_currentPowers,
			_v,
			_r,
			_s,
			_theHash,
			_powerThreshold
		);
	}

As you can see it acceptes an array of addresses and data with no limitation, now as a malicious actor by calling that function (since it's public) with multiple data this will makes the contract consumes more gas from its level (not from user side) and this will later makes the contract ra out of gas, and will make the current block get stuffed (in case it passes the GAS limit set)

example :

call it as : testCheckValidatorSignatures(["0x00","0x00","0x00","0x00","0x00","0x00","0x00","0x00"],[1,1,1,1,1],[1,1,1,1,1],...etc)

notice the more objects you add into arrays the more gas is being consumed from the contract

fix : make the data bounded :

	function testCheckValidatorSignatures(
		address[] memory _currentValidators,
		uint256[] memory _currentPowers,
		uint8[] memory _v,
		bytes32[] memory _r,
		bytes32[] memory _s,
		bytes32 _theHash,
		uint256 _powerThreshold
	) public pure {
               require(_currentValidators,
			_currentPowers.length < 5,"please call a lower objects"  &&
			_v.length < 5,"please call a lower objects" &&
			_r.length < 5,"please call a lower objects" &&
			_s.length < 5,"please call a lower objects" &&
			_theHash.length < 5,"please call a lower objects" && 
			_powerThreshold.length < 5,"please call a lower objects" )
		checkValidatorSignatures(
			_currentValidators,
			_currentPowers,
			_v,
			_r,
			_s,
			_theHash,
			_powerThreshold
		);
	}