__141345__ - DoS when accruing Premium

[github-actions[bot]]

141345

medium

DoS when accruing Premium

Summary

The activeProtectionIndexes array could grow unbounded and result in DoS when accruing Premium.

Vulnerability Detail

When crate protection, there is no limit on how many protections can be created.

File: contracts/core/pool/ProtectionPool.sol
795:   function _verifyAndCreateProtection() {

887:     lendingPoolDetail.activeProtectionIndexes.add(_protectionIndex);
888:     protectionBuyerAccounts[msg.sender].activeProtectionIndexes.add(
889:       _protectionIndex
890:     );

As a result, the activeProtectionIndexes array could grow quite large, the transaction’s gas cost could exceed the block gas limit and make it impossible to call this function lockCapital() at all. Since inside the for loop, there are storage load and function calls, the gas cost of these are relatively high.

963:   function _accruePremiumAndExpireProtections(

980:     uint256 _length = _protectionIndexes.length;
981:     for (uint256 j; j < _length; ) {
982:       uint256 _protectionIndex = _protectionIndexes[j];
983:       ProtectionInfo storage protectionInfo = protectionInfos[_protectionIndex];

Impact

The pool could fail to accrue Premium. The contract could not deliver expected functionality.

Code Snippet

https://github.com/sherlock-audit/2023-02-carapace/blob/main/contracts/core/pool/ProtectionPool.sol#L980-L1020

https://github.com/sherlock-audit/2023-02-carapace/blob/main/contracts/core/pool/ProtectionPool.sol#L871-L882

Tool used

Manual Review

Recommendation

Consider introducing a reasonable upper limit based on block gas limits. For large size activeProtectionIndexes array, the handling of accruing Premium can be break into separate parts with different function calls, and combine the results at last in another function.

Duplicate of #63