Submitted by Bauchibred
ChefIncentivesController#Claim() is a public function and callable by anyone. When claiming, there is a need to vest the tokens, now this vesting directly vests to the multifeedistributor.
In MultiFeeDistribution#vestTokens(), there is a logic to only allow pushing a new entry for a user to his _userEarnings array once in a day. These rewards are then kept, and then after the vesting period a user can claim their rewards, where the _userEarnings array would be looped through.
Now from the links to the necessary functions attached, we can see that there is no minimum claimants to be made, asides the check that RDNT must be > 0, however as little as 1 is allowed.
For active users that could earn even if little rewards per day, this then allows a malicious user to cause a permanent DOS to claiming their vested tokens, since all the attacker has to do, is once a day for as long as the vesting duration query, which could in valid scenarios be quite lengthy query ChefIncentivesController#Claim() while passing the users address. Then, when the user comes to withdraw their vested tokens, the loop OOGs and then reverts due to the amount of entries in the _userEarnings array .
Potential permanent DOS to honest users (or force the users to incur losses since some tech savvy users can notice this griefing attempt, but to stop this theyd have to withdraw early which forces them to incur losses, since even if the vesting duration reduces there is no other method for the user to withdraw their tokens and its stuck in the protocol. Alternatively, if the user leaves the claiming of their tokens even after the vesting period and does not immediately withdraw; the chances of this happening heavily increases since with each day an entry to the _userEarnings array can be made.
Consider introducing some access control to ChefIncentivesController#Claim() and only allow the users call this for themselves.
DoS
amarcu (LoopFi) confirmed and commented:
Koolex (judge) decreased severity to Medium
0xAlix2 (warden) commented:
Bauchibred (warden) commented:
Koolex (judge) commented:
