Possible infinite loop in _decrementWeightUntilFree()

[c4-bot-4]

Lines of code

https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/main/src/tokens/ERC20Gauges.sol#L515-L536

Vulnerability details

Impact

In _decrementWeightUntilFree() there is a great possibility of an Infinite loop. This is because i++ is an increment inside if condition. This can lead to excessive gas consumption, causing the Ethereum transaction to fail due to the gas limit.

Proof of Concept

In ERC20Gauges.sol we have _decrementWeightUntilFree() which use greedy algorithm for freeing weight.
In the loop of the _decrementWeightUntilFree() method, the position of i++ is wrong, which may lead to an infinite loop:

        for (
            uint256 i = 0;
            i < size && (userFreeWeight + userFreed) < weight;
        ) {
            address gauge = gaugeList[i];
            uint256 userGaugeWeight = getUserGaugeWeight[user][gauge];
            if (userGaugeWeight != 0) {
                userFreed += userGaugeWeight;
                _decrementGaugeWeight(user, gauge, userGaugeWeight);

                // If the gauge is live (not deprecated), include its weight in the total to remove
                if (!_deprecatedGauges.contains(gauge)) {
                    totalTypeWeight[gaugeType[gauge]] -= userGaugeWeight;
                    totalFreed += userGaugeWeight;
                }

                unchecked { 
                    ++i; //@audit- infinity loop
                }
            }
        }

As we can see i++ is incremented only when userGaugeWeight != 0 is true.
If we don't enter the if condition, i won't increase and so we get an infinite loop.

Tools Used

Visual Studio Code

Recommended Mitigation Steps

To avoid this potential infinite loop, move the unchecked box outside the if condition.

Assessed type

Loop

[c4-pre-sort]

0xSorryNotSorry marked the issue as sufficient quality report

[c4-pre-sort]

0xSorryNotSorry marked the issue as duplicate of #152

[c4-judge]

Trumpero changed the severity to QA (Quality Assurance)

[c4-judge]

Trumpero marked the issue as grade-b