Lines of code
<https://github.com/code-423n4/2022-09-vtvl/blob/f68b7f3e61dad0d873b5b5a1e8126b839afeab5f/contracts/VTVLVesting.sol#L302&gt;
<https://github.com/code-423n4/2022-09-vtvl/blob/main/contracts/VTVLVesting.sol#L245-L304&gt;

Vulnerability details

Impact

Modifying an array of unknown size, that increases in size over time in the function _createClaimUnchecked() can lead to Deniel of Service.
<https://github.com/code-423n4/2022-09-vtvl/blob/f68b7f3e61dad0d873b5b5a1e8126b839afeab5f/contracts/VTVLVesting.sol#L53&gt;
<https://github.com/code-423n4/2022-09-vtvl/blob/f68b7f3e61dad0d873b5b5a1e8126b839afeab5f/contracts/VTVLVesting.sol#L302&gt;
<https://github.com/code-423n4/2022-09-vtvl/blob/main/contracts/VTVLVesting.sol#L245-L304&gt;

Proof of Concept

When smart contracts are deployed or functions inside them are called, the execution of these actions always requires a certain amount of gas, based of how much computation is needed to complete them. The Ethereum network specifies a block gas limit and the sum of all transactions included in a block can not exceed the threshold. Modifying the array vestingRecipients of unknown size, that increases in size over time, can lead to such a Denial of Service condition, when the cost of executing a function exceeds the block gas limit.

Tools Used

Manual review.

Recommended Mitigation Steps

Caution is advised when you expect to have large arrays that grow over time. Actions that require looping across the entire data structure should be avoided. If you absolutely must loop over an array of unknown size, then you should plan for it to potentially take multiple blocks, and therefore require multiple transactions.

The text was updated successfully, but these errors were encountered:

👎 2 indijanc and Minh-Trng reacted with thumbs down emoji

All reactions

• 👎 2 reactions