ast3ros - [M-02] receivingFunds is subjected to DDOS attacks

[github-actions]

ast3ros

medium

[M-02] receivingFunds is subjected to DDOS attacks

Summary

When receiving funds, the receivingFunds function allow maximum of not-yet-whitelist tokens to be deposited into the bounty.
https://github.com/sherlock-audit/2023-02-openq/blob/main/contracts/DepositManager/Implementations/DepositManagerV1.sol#L45-L50

A malicious account could deposit any ERC20 tokens they want into bounty with the amount of 1 wei. If they deposit number of tokens equal TOKEN_ADDRESS_LIMIT, the bounty will not accept any valid tokens from the issuer.

Vulnerability Details

The receivingFunds function accept any ERC20 tokens and record it to tokenAddresses set.
https://github.com/sherlock-audit/2023-02-openq/blob/main/contracts/DepositManager/Implementations/DepositManagerV1.sol#L45-L50
https://github.com/sherlock-audit/2023-02-openq/blob/main/contracts/Bounty/Implementations/BountyCore.sol#L55

The length of the tokenAddresses set can be manipulated by any external account.

Impact

• Issuers could not fund the bounty with their valid tokens because the number of tokens is TOKEN_ADDRESS_LIMIT.
• The gas cost for operations that needs to loop through tokenAddresses set is higher.

Code Snippet

https://github.com/sherlock-audit/2023-02-openq/blob/main/contracts/DepositManager/Implementations/DepositManagerV1.sol#L45-L50
https://github.com/sherlock-audit/2023-02-openq/blob/main/contracts/Bounty/Implementations/BountyCore.sol#L55

Tool used

Manual

Recommendation

Allow issuers to whitelist token address for their own bounty. The bounty only receives funds using whitelist tokens

Duplicate of #530