Submitted by kirk-baird, also found by csanuragjain, Dravee, gzeon, IllIllI, Koustre, Ruhum, unforgiven, VAD37, and xiaoming90
https://github.com/code-423n4/2022-05-vetoken/blob/2d7cd1f6780a9bcc8387dea8fecfbd758462c152/contracts/VE3DRewardPool.sol#L102-L112
https://github.com/code-423n4/2022-05-vetoken/blob/2d7cd1f6780a9bcc8387dea8fecfbd758462c152/contracts/VE3DLocker.sol#L145-L172
The function addReward() allows the owner to add a new reward token to the list rewardTokens.
However, this is an unbounded list that when appended to cannot be shortened. The impact is it is possible to reach a state where the list is so long it cannot be iterated through due to the gas cost being larger than the block gas limit. This would cause a state where all transactions which iterate over this list will revert.
Since the modifier updateReward() iterates over this list it is possible that there will reach a state where the we are unable to call any functions with this modifier. The list includes
As a result it would therefore be impossible to withdraw any rewards from this contract.
The same issue exists in VE3DLocker.  Where rewards can be added by either Booster or the owner.
Consider having some method for removing old reward tokens which are no longer in use.
Alternatively set a hard limit on the number of reward tokens that can be added.
A different option is to allow rewards to be iterated and distributed on a per token bases rather than all tokens at once.
jetbrain10 (veToken Finance) disagreed with severity and commented:
Alex the Entreprenerd (judge) commented:
Alex the Entreprenerd (judge) commented:
