Function _getFinalContribution() loops throw all contributions which have been added by contributor. If there are too many contributions then _getFinalContribution() will be reverted due to reaching the block gas limit.
Function _burn() calls _getFinalContribution(). If _getFinalContribution reverts due to reaching the block gas limit, the _burn() will not be available to be called because contributor can't reduce the number of contributions.
If _burn() will be reverted then user's ETH will be locked.
Proof of Concept
If there are too many contributions then _getFinalContribution() will be reverted due to reaching the block gas limit.
Function _burn() calls _getFinalContribution() here. If _getFinalContribution() reverts due to reaching the block gas limit, the _burn() will be revered too.
Lines of code
https://github.com/PartyDAO/party-contracts-c4/blob/main/contracts/crowdfund/Crowdfund.sol#L339-L376
Vulnerability details
Impact
Function _getFinalContribution() loops throw all contributions which have been added by contributor. If there are too many contributions then _getFinalContribution() will be reverted due to reaching the block gas limit.
Function _burn() calls _getFinalContribution(). If _getFinalContribution reverts due to reaching the block gas limit, the _burn() will not be available to be called because contributor can't reduce the number of contributions.
If _burn() will be reverted then user's ETH will be locked.
Proof of Concept
If there are too many contributions then _getFinalContribution() will be reverted due to reaching the block gas limit.
https://github.com/PartyDAO/party-contracts-c4/blob/main/contracts/crowdfund/Crowdfund.sol#L339-L376
Function _contribute() has no limits when adding a new contribution.
Function _burn() calls _getFinalContribution() here. If _getFinalContribution() reverts due to reaching the block gas limit, the _burn() will be revered too.
Tools Used
Manual review
Recommended Mitigation Steps
Limit number of contributions that can be added.