_decrementWeightUntilFree(...) could turn into an infinite loop

[code423n4]

Lines of code

https://github.com/code-423n4/2023-05-maia/blob/54a45beb1428d85999da3f721f923cbf36ee3d35/src/erc-20/ERC20Gauges.sol#L536-L551

Vulnerability details

Impact

_decrementWeightUntilFree(...) can be stuck in an infinite loop and this will potentially cause a DOS for all function calls that depend on it.

Proof of Concept

if the weight of the gauge in the loop is 0 this function will be stuck in an infinite loop because the loop counter i will not be incremented.
For instance, if there are 10 gauges, and the 4th gauge (i = 3) has a weight of 0, the loop will continue from i = 3 and be stuck there until the caller runs out of gas this can lead to a denial of service

        for (uint256 i = 0; i < size && (userFreeWeight + totalFreed) < weight;) {
            ...
            if (userGaugeWeight != 0) {
                ...

                unchecked {
                    i++;
                }
            }
        }

Tools Used

VS code

Recommended Mitigation Steps

Bring the loop increment counter outside the if block

        for (uint256 i = 0; i < size && (userFreeWeight + totalFreed) < weight;) {
            ...
            if (userGaugeWeight != 0) {
                ...


            }
            unchecked {
               i++;
            }
        }

Assessed type

Loop

[c4-judge]

trust1995 marked the issue as duplicate of #260

[c4-judge]

trust1995 marked the issue as satisfactory

[c4-judge]

trust1995 marked the issue as partial-50

[c4-judge]

trust1995 changed the severity to 2 (Med Risk)

[c4-judge]

trust1995 marked the issue as duplicate of #717