getReward() is susceptible to DoS with block gas limit

[code423n4]

Lines of code

https://github.com/code-423n4/2022-05-aura/blob/main/contracts/AuraLocker.sol#L303-L318

Vulnerability details

Impact

getReward() is a public function and the for loop within runs as many times as rewardTokens.length. Hence, if rewardTokens.length is big enough, DoS with block gas limit can occur.

Proof of Concept

https://consensys.github.io/smart-contract-best-practices/attacks/denial-of-service/#dos-with-block-gas-limit

Tools Used

Manual analysis

Recommended Mitigation Steps

I suggest to limit the max number of loop iterations to prevent hitting block gas limit.

[0xMaharishi]

Dupe of #178

[dmvt]

As mentioned on #178, this is highly unlikely to occur. The admin has every incentive not to do this and the ability to rectify the issue if it does accidentally occur. I view this as a QA issue due to how unlikely it is.

[dmvt]

Grouping this with the warden’s QA report, #203