Fund With The Zero Amount Leads To DOS On The Contract

[code423n4]

Lines of code

https://github.com/code-423n4/2022-05-aura/blob/main/contracts/AuraVestedEscrow.sol#L96

Vulnerability details

Impact

On the contract, Recipients can be funded with rewardTokens through fund function. However, the external call can be made with zero amount and totally will lock fund function with initialised variable.

Proof of Concept

1. Navigate to the following contract.

https://github.com/code-423n4/2022-05-aura/blob/main/contracts/AuraVestedEscrow.sol#L96

2. Amounts array can be filled with "0"s. With the "0" amount, the contract funding totally will be useless and that will cause to DOS in the contract.

    function fund(address[] calldata _recipient, uint256[] calldata _amount) external nonReentrant {
        require(!initialised, "initialised already");

        uint256 totalAmount = 0;
        for (uint256 i = 0; i < _recipient.length; i++) {
            uint256 amount = _amount[i];

            totalLocked[_recipient[i]] += amount;
            totalAmount += amount;

            emit Funded(_recipient[i], amount);
        }
        rewardToken.safeTransferFrom(msg.sender, address(this), totalAmount);
        initialised = true;
    }

Tools Used

code review

Recommended Mitigation Steps

Ensure that funding didn't complete with "zero amount". Compare _recipient and _amount size in the function. If arrays sizes are not equal, the function always will revert.

[0xMaharishi]

duplicate of #305 etc

[dmvt]

I'm going to downgrade this one to a gas issue given that the worst impact is a required redeploy. The suggested mitigation is valid.

[dmvt]

Grouping this with the warden’s gas report, #321