search

code-423n4 / 2022-02-aave-lens-findings

0 stars 0 forks source link

QA Report #63

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Title

Costly operations inside unbounded for loop

Impact

ApprovalFollowModule contract contains for loop which updates the state variable _approvedByProfileByOwner

Proof of Concept

This can be found in the following lines:

  1. https://github.com/aave/lens-protocol/blob/main/contracts/core/modules/follow/ApprovalFollowModule.sol#L41-L43
  2. https://github.com/aave/lens-protocol/blob/main/contracts/core/modules/follow/ApprovalFollowModule.sol#L66-L68

Tools Used

Manual review

Recommended Mitigation Steps

Alternatively a local variable may be assigned temporarily and then assigned to state

Zer0dot commented 2 years ago

I think this is invalid? I'm not sure I get it, but we need to update the storage anyway.

0xleastwood commented 2 years ago

I don't believe the suggestion provided by the warden is possible. The storage variable must be accessed directly on each iteration.