GetInflationAmount can run out of gas

[code423n4]

Lines of code

https://github.com/code-423n4/2022-12-gogopool/blob/main/contracts/contract/RewardsPool.sol#L74

Vulnerability details

Impact

The loop within getInflationAmount can run out of gas, irreversibly breaking the contract

Proof of Concept

Currently, the function startRewardsCycle calls inflate which then calls getInflationAmount in order to receive the inflated supply. However, during the function getInflationAmount it loops over all inflationIntervalsElapsed, which is in most cases 28 days, when called regularly. However, if startRewardsCycle is not called regularly, this means that inflationIntervalStartTime is not updated regularly: addUint(keccak256("RewardsPool.InflationIntervalStartTime"), inflationIntervalElapsedSeconds); this will then eventually lead to to a DoS where the loop runs out of gas for (uint256 i = 0; i < inflationIntervalsElapsed; i++) { due to too many elapsed inflation intervals.

Tools Used

VSCode

Recommended Mitigation Steps

Currently, there is no easy solution. One could implement pagination for the loop to prevent this issue, however, this would need a larger logic change. Therefore our recommendation is to a) keep an eye on the duration time and b) eventually use chainlink automation to call startRewardsCycle every 28 days.

Eventually, one could also set an upper limit of inflationIntervalsElapsed and if this limit is exceeded, simply exceed e.g. 50 loops.

https://docs.chain.link/chainlink-automation/introduction

*This is the first contest i took part, therefore my submissions might not be ideal yet, if there are any questions feel free to contact me directly in discord :-)

** While this issue initially was assessed as HIGH, we think that MEDIUM is here more appropriate because we do not see this happening in production (it would take quite some weeks of forgetting to call the function), however, the code itself is still vulnerable for this issue and in our opinion this is what counts.

[c4-judge]

GalloDaSballo marked the issue as duplicate of #139

[c4-judge]

GalloDaSballo marked the issue as not a duplicate

[c4-judge]

Duplicate of #710

[GalloDaSballo]

L