# Most KeyRegistry, VotingPowerProvider functions can be DoSed Medium · Sherlock · Staking · 19th June 2025 Finding M-4 of the Symbiotic Relay competition. - Protocol: https://audits.sherlock.xyz/contests/967 - Codebase: https://github.com/0xsimao/2025-06-symbiotic-relay/tree/435a21fd81bcd588439feef3108580f535b9e5eb - Source: https://github.com/sherlock-audit/2025-06-symbiotic-relay-judging/issues/403 --- ### Summary `VotingPowerProvider::registerOperator()` is [permissionless](https://github.com/sherlock-audit/2025-06-symbiotic-relay/blob/main/middleware-sdk/src/contracts/modules/voting-power/VotingPowerProvider.sol#L340-L342), so anybody can call it with any number of accounts to DoS all functions that gather operator information, such as `getOperatorsAt()`, `getOperators()`. Same for the vaults of the operators `getOperatorVaults()`, which can be registered via `_registerOperatorVault()` (part of the `OperatorVaults` extension or the auto deployment `OpNetVaultAutoDeploy` extension). The `KeyRegistry` also has this issue, as [`setKey()`](https://github.com/sherlock-audit/2025-06-symbiotic-relay/blob/main/middleware-sdk/src/contracts/modules/key-registry/KeyRegistry.sol#L202) is permissionless, and [`getKeys()`](https://github.com/sherlock-audit/2025-06-symbiotic-relay/blob/main/middleware-sdk/src/contracts/modules/key-registry/KeyRegistry.sol#L152) will be DoSed as anybody can create any number of ethereum addresses as operators and keys to DoS the function. As part of the SDK, these functions are key and should be paginated. They will be DoSed on chain due to the gas limit and off chain due to rpc timeout limits. ### Root Cause In `KeyRegistry`, `VotingPowerProvider`, there is no limit on some array elements nor pagination. ### Internal Pre-conditions None. ### External Pre-conditions None. ### Attack Path 1. Attacker creates multiple wallets to DoS the function calls. ### Impact Key view functions for key, operators are DoSed. ### PoC _No response_ ### Mitigation Add pagination. --- Related findings: - [Most `ManagedLeveragedVault` functions are DoSed due to bad debt check](https://0xsimao.com/findings/beraborrow-i-managed-functions-bad-debt): Beraborrow Managed Dens