Submitted by danb, also found by cmichel, csanuragjain, hyh, kirk-baird, leastwood, Meta0xNull, minhquanym, Omik, robee, Ruhum, and throttle
https://github.com/code-423n4/2022-02-hubble/blob/main/contracts/VUSD.sol#L53
processWithdrawals can process limited amount in each call.
An attacker can push to withdrawals enormous amount of withdrawals with amount = 0.
In order to stop the dos attack and process the withdrawal, the governance needs to spend as much gas as the attacker.
If the governance doesnt have enough money to pay for the gas, the withdrawals cant be processed.
Alice wants to attack vusd, she spends 1 millions dollars for gas to push as many withdrawals of amount = 0 as she can.
If the governance wants to process the deposits after Alices empty deposits, they also need to spend at least 1 million dollars for gas in order to process Alices withdrawals first.
But the governance doesnt have 1 million dollars so the funds will be locked.
Set a minimum amount of withdrawal. e.g. 1 dollar
atvanguard (Hubble) confirmed, but disagreed with High severity and commented:
atvanguard (Hubble) resolved
moose-code (judge) commented:
moose-code (judge) commented:
