code-423n4 / 2022-01-sherlock-findings

0 stars 0 forks source link

Repeated calls might lead to DoS #247

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

0v3rf10w

Vulnerability details

Impact

Calls inside a loop might lead to a denial-of-service attack. If one of the tokens reverts, then it will continue repeatedly.

Proof of Concept

SherBuy.sweepTokens(IERC20[]) (contracts/SherBuy.sol#181-190)
token.safeTransfer(msg.sender,token.balanceOf(address(this))) (contracts/SherBuy.sol#188)

Recommended Mitigation Steps

https://eth.wiki/en/howto/smart-contract-safety#favor-pull-over-push-for-external-calls

Evert0x commented 2 years ago

owner can remove DoS token from function argument