098.md

Loud Snowy Marmot

Medium

L0ckin7 - Unbounded Loops in _processRewardsToPodLp

L0ckin7 Medium

Summary

The _processRewardsToPodLp function iterates over an array of reward tokens (_tokens). Could hit block gas limit if too many reward tokens are added.

https://github.com/sherlock-audit/2025-01-peapods-finance/blob/main/contracts/contracts/AutoCompoundingPodLp.sol#L213

Impact

If the array is too large, the transaction could run out of gas, causing a denial of service.

Recommendations

Limit the number of tokens that can be processed in a single transaction or allow processing in batches.

function _processRewardsToPodLp(uint256 _amountLpOutMin, uint256 _deadline) internal returns (uint256 _lpAmtOut) {
    if (!yieldConvEnabled) {
        return _lpAmtOut;
    }
    address[] memory _tokens = ITokenRewards(IStakingPoolToken(_asset()).POOL_REWARDS()).getAllRewardsTokens();
    uint256 _len = _tokens.length + 1;
    require(_len <= 10, "Too many tokens"); // Example limit
    for (uint256 _i; _i < _len; _i++) {
        // Existing logic
    }
}