Skip to content
Request an audit

‹ All findings

BatchOut:withdrawFulfill() can be DoSed by spamming withdrawal requests, leading to OOG reverts

Crit/HighClip Finance Strategies·Three Sigma · DeFi infrastructure · 10th November, 20233S-Clip Finance-H04

ReportSource

Description

Anyone can schedule as many withdrawals as they want in BatchOut:scheduleWithdraw(), specifying little shares to different withdrawTo addresses. Then, in withdrawFulfill(), it will loop over all the requests in the cycle, leading to OOG reverts if enough requests were spammed.

Recommendation

Send as argument a number of requests to fulfill, so the OOG revert can be prevented.

Status

Addressed in #4dc4687