rvierdiiev - DepositManagerV1.refundDeposit will revert when big number of deposits will be created in bounty

[github-actions]

rvierdiiev

medium

DepositManagerV1.refundDeposit will revert when big number of deposits will be created in bounty

Summary

DepositManagerV1.refundDeposit will revert when big number of deposits will be created in bounty. This is because BountyCore.getLockedFunds will revert with out of gas error. As result it will be not possible to refund deposit.

Vulnerability Detail

When depositor creates new deposit, then it is added to the deposit array.
It's possible that the bounty contract will contain a lot of different deposits, so the number will increase with time.

In order to refund deposit, user calls DepositManagerV1.refundDeposit. This function will then call bounty.getLockedFunds in order to receive locked tokens amount.

https://github.com/sherlock-audit/2023-02-openq/blob/main/contracts/Bounty/Implementations/BountyCore.sol#L333-L352

    function getLockedFunds(address _depositId)
        public
        view
        virtual
        returns (uint256)
    {
        uint256 lockedFunds;
        bytes32[] memory depList = this.getDeposits();
        for (uint256 i = 0; i < depList.length; i++) {
            if (
                block.timestamp <
                depositTime[depList[i]] + expiration[depList[i]] &&
                tokenAddress[depList[i]] == _depositId
            ) {
                lockedFunds += volume[depList[i]];
            }
        }


        return lockedFunds;
    }

As you can see, this function iterates over all deposits array and in case if it's too big, then it will just revert with out of gas error.

Also pls, note that anyone can create new deposit with 0 amount(using token address 0 and msg.value 0), so it allows to create a lot of deposits in order to prevent depositor from refunding if it's needed.

Impact

It will be not possible to refund deposit.

Code Snippet

https://github.com/sherlock-audit/2023-02-openq/blob/main/contracts/DepositManager/Implementations/DepositManagerV1.sol#L152-L195
https://github.com/sherlock-audit/2023-02-openq/blob/main/contracts/Bounty/Implementations/BountyCore.sol#L333-L352

Tool used

Manual Review

Recommendation

Add some deposit limit amount to the bounty, or think about another way to get deposits in specific token.

Duplicate of #77