Summary
VotingPowerProvider::registerOperator() is permissionless, so anybody can call it with any number of accounts to DoS all functions that gather operator information, such as getOperatorsAt(), getOperators(). Same for the vaults of the operators getOperatorVaults(), which can be registered via _registerOperatorVault() (part of the OperatorVaults extension or the auto deployment OpNetVaultAutoDeploy extension).
The KeyRegistry also has this issue, as setKey() is permissionless, and getKeys() will be DoSed as anybody can create any number of ethereum addresses as operators and keys to DoS the function.
As part of the SDK, these functions are key and should be paginated. They will be DoSed on chain due to the gas limit and off chain due to rpc timeout limits.
Root Cause
In KeyRegistry, VotingPowerProvider, there is no limit on some array elements nor pagination.
Internal Pre-conditions
None.
External Pre-conditions
None.
Attack Path
- Attacker creates multiple wallets to DoS the function calls.
Impact
Key view functions for key, operators are DoSed.
Mitigation
Add pagination.