Skip to content
Request an audit

‹ Findings database

SortedLinkedList::getAllValues() could add a paginated function to prevent DoS

Low/InfoMaple Withdrawal Queue audit·Sherlock·Institutional lending·22nd October, 2025·by 0xSimaoL-3

Summary

SortedLinkedList::getAllValues() fetches all values from the list, which may be DoSed, both on chain and through certain rpc providers that may timeout.

Vulnerability Detail

There are onchain gas limits and rpc providers may timeout even if there isn't an offchain limit.

Impact

Code Snippet

https://github.com/sherlock-audit/2025-10-maple-oct-22nd/pull/26/files#diff-039b765c6733ead864f7a36bdbf1e880064e5d25e276a3b3cde1cb4935dc7e12R101

Tool Used

Manual Review

Recommendation

Usually a separate paginated function is added as an alternative.

Source

Disclosed by 0xSimao · Sherlock's 2025 Watson of the Year · 21 first places in 57 audit contests