massUpdatePools() is susceptible to DoS with block gas limit

[code423n4]

Lines of code

https://github.com/code-423n4/2022-05-aura/blob/main/convex-platform/contracts/contracts/ConvexMasterChef.sol#L178-L183

Vulnerability details

Impact

massUpdatePools() is a public function and it calls the updatePool() function for the length of poolInfo. Hence, it is an unbounded loop, depending on the length of poolInfo.
If poolInfo.length is big enough, block gas limit may be hit.

Proof of Concept

https://consensys.github.io/smart-contract-best-practices/attacks/denial-of-service/#dos-with-block-gas-limit

Tools Used

Manual analysis

Recommended Mitigation Steps

I suggest to limit the max number of loop iterations to prevent hitting block gas limit.

[0xMaharishi]

Dupe of #147

[dmvt]

This is not a duplicate of #147 and is also clearly documented as a potential issue in the code itself. If the admin were to accidentally add too many pools the contract would be effected, but the likelihood of this is low and if it were to happen, the admin could still turn off the pools and migrate to another contract. This would, however, effect the protocol in a severely negative way. Not fully updating all of the pools would potentially cause accounting issue and lead to loss of earned rewards. Given the impact and likelihood together, I think medium is actually a reasonable in this case.

[IllIllI000]

@dmvt The massUpdatePool() function was found to be non-critical in previous contests (code-423n4/2022-02-concur-findings#161) and when I filed the issue with Convex for their bug bounty, they rejected it saying it was a "non-issue" and didn't meet their criteria for a bounty. Furthermore, ConvexMasterChef.sol is not listed as in scope for this contest: https://github.com/code-423n4/2022-05-aura#contracts-of-interest

[dmitriia]

Actually the scope was all non-test contracts, https://github.com/code-423n4/2022-05-aura#repo

[dmvt]

@dmvt The massUpdatePool() function was found to be non-critical in previous contests (code-423n4/2022-02-concur-findings#161) and when I filed the issue with Convex for their bug bounty, they rejected it saying it was a "non-issue" and didn't meet their criteria for a bounty. Furthermore, ConvexMasterChef.sol is not listed as in scope for this contest: https://github.com/code-423n4/2022-05-aura#contracts-of-interest

Unlike the other contest, massUpdatePools() is used in this contract. I'm going to keep this as medium.