Platform: Code4rena
Start Date: 28/01/2022
Pot Size: $30,000 USDC
Total HM: 4
Participants: 22
Period: 3 days
Judge: GalloDaSballo
Total Solo HM: 2
Id: 80
League: ETH
Rank: 6/22
Findings: 1
Award: $881.09
🌟 Selected for report: 1
🚀 Solo Findings: 0
🌟 Selected for report: pants
881.0898 USDC - $881.09
pants
The attacker can push unlimitedly to an array, that some function loop over this array. If increasing the array size enough, calling the function that does a loop over the array will always revert since there is a gas limit. This is an High Risk issue since those arrays are publicly allows to push items into them.
In ConvexStakingWrapper.sol L285, L269, L311 there is an unbounded loop on the array 'rewards' that can be publicly pushed by ['addRewards'].
#0 - alcueca
2022-01-28T15:56:12Z
There are no loops at those addresses, and addRewards adds rewards that have been added to the staking pool, not at the user's will.
#1 - alcueca
2022-02-03T10:25:29Z
Actually, this is a real vulnerability. I wouldn't say that it is a Sev 3 because funds won't be at risk until rewards are added into the staking pool, and then it would be a DoS, not an asset loss. In my mind that's a Medium downgraded to Low because of the conditionant.
#2 - alcueca
2022-02-10T09:57:58Z
Upon further inspection, the startIndex is set to equal the length of the rewards array before adding any new rewards. This means that the rewards array in the wrapper can only grow to the size of the rewards array in the pool.
#3 - GalloDaSballo
2022-02-18T00:51:12Z
Anytime there's a loop where the input comes from an external source there's the possibility of unbounded looping.
The DOS can factually happen, specifically here: https://github.com/code-423n4/2022-01-yield/blob/e946f40239b33812e54fafc700eb2298df1a2579/contracts/ConvexStakingWrapper.sol#L286
Which can prevent from claiming rewards.
This can happen exclusively if the Convex Team adds thousands of additional rewards to their staking pool, while this can happen and the DOS can happen, I believe the likelihood to be minimal.
Given that the risk is loss of rewards, I believe the finding should be downgraded to medium Given the extreme unlikelihood that there will ever be thousands of additional rewards, I believe low severity to be more appropriate.
#4 - alcueca
2022-02-21T09:28:10Z
Agree, thank you.