Submitted by 0xRajeev
Trading function executeTrade() batch executes maker/taker orders against a market. The trader/interface provides arrays of makers/takers which is unbounded. As a result, if the number of orders is too many, there is a risk of this transaction exceeding the block gas limit (which is 15 million currently). See Trader.sol L67 and L78
The impact is that if executeTrade() is called with too many orders in the batch, the transaction might exceed block gas limit and revert, resulting in none of the orders are executed.
See similar medium-severity finding from ConsenSyss Audit of Growth DeFi.
Recommend limiting the number or orders executed based on gasleft() after every iteration, or estimating the gas cost and enforcing an upper bound on the number of orders allowed in maker/taker arrays.
raymogg (Tracer) confirmed
