Is Possible onlyGovernance Lock Users Fund by Setting maxWithdrawalProcesses Over Blockchain Gas Limit

[code423n4]

Lines of code

https://github.com/code-423n4/2022-02-hubble/blob/main/contracts/VUSD.sol#L73-L74
https://github.com/code-423n4/2022-02-hubble/blob/main/contracts/VUSD.sol#L48-L50
https://github.com/code-423n4/2022-02-hubble/blob/main/contracts/VUSD.sol#L53-L57

Vulnerability details

Impact

1. onlyGovernance Call function setMaxWithdrawalProcesses() and Set maxWithdrawalProcesses More Than Blockchain Gas Limit
2. Lot of users Call function withdraw() and Withdrawal Waiting List getting more and more. (Anyone can Making Multiple Small Requests to withdraw() and make the waiting list go up very fast)

while (i < withdrawals.length && (i - start) <= maxWithdrawalProcesses) {

3. User call function processWithdrawals() but encounter gas error.

ETH Block Gas Limit = 30,000,000
ERC20 Transfer Gas Limit = 65,000

Need Only 462 simple ERC20 Token Transfer to Over Block Gas Limit.

Thus, is possible onlyGovernance Lock Users Fund by Setting maxWithdrawalProcesses Over Blockchain Gas Limit.

Proof of Concept

https://github.com/code-423n4/2022-02-hubble/blob/main/contracts/VUSD.sol#L73-L74
https://github.com/code-423n4/2022-02-hubble/blob/main/contracts/VUSD.sol#L48-L50
https://github.com/code-423n4/2022-02-hubble/blob/main/contracts/VUSD.sol#L53-L57

Tools Used

Manual Review

Recommended Mitigation Steps

In function setMaxWithdrawalProcesses(), require input _maxWithdrawalProcesses not to More Than Blockchain Gas Limit.
require(_maxWithdrawalProcesses <= 200, 'WithdrawalProcesses Over 200');

[atvanguard]

Duplicate of #40

[moose-code]

Some sensible input validation could be used for this.

[JeeberC4]

Grouping with warden's QA report #69