search

code-423n4 / 2021-07-spartan-findings

0 stars 0 forks source link

Unbounded iteration in Synth Vault #163

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

cmichel

Vulnerability details

Vulnerability Details

The SynthVault.harvestAll iterates over all stakedSynthAssets. Anyone can push to this array by creating a synth over curated assets.

Impact

The transactions can fail if the arrays get too big and the transaction would consume more gas than the block limit.

Recommended Mitigation Steps

Keep the number of synths/curated pools small.

verifyfirst commented 3 years ago

only one synth can exist per curated asset. There is a 10 curatedPool limit in place for this.

ghoul-sol commented 3 years ago

Per sponsor comment, invalid