ltyu - Refunds can be blocked by deposits

[github-actions]

ltyu

high

Refunds can be blocked by deposits

Summary

Excess deposits can block deposit refunds

Vulnerability Detail

In DepositManagerV1.sol, a depositor can get a refund for their deposits by calling refundDeposit(). The availableFunds are then calculated by looping through the deposit list and validating the lockedFunds. This is problematic because anyone can create deposits. An attacker (or legitimate users) can deposit dust amounts and cause this array to get too big. The loop would then cause this validation to run out of gas.

Impact

Code Snippet

There is no validation for the size of deposit
https://github.com/sherlock-audit/2023-02-openq/blob/main/contracts/Bounty/Implementations/BountyCore.sol#L21-L58

Tool used

At the last line of this snippet, the availableFunds are calculated. A loop is used in bounty.getLockedFunds(depToken)
https://github.com/sherlock-audit/2023-02-openq/blob/main/contracts/DepositManager/Implementations/DepositManagerV1.sol#L152-L172

lockedFunds calculated here
https://github.com/sherlock-audit/2023-02-openq/blob/main/contracts/Bounty/Implementations/BountyCore.sol#L333-L352

Manual Review

Recommendation

• Consider a minimum deposit amount to reduce this attack vector

Duplicate of #77