Oxd1z - calls-loop

[sherlock-admin2]

Oxd1z

medium

calls-loop

Summary

Calls inside the loop might lead to a denial-of-service attack.

Vulnerability Detail

LockingPositionDelegate.manageOwnedAndDelegated(LockingPositionDelegate.OwnedAndDelegated) has external calls inside a loop: require(bool,string)(msg.sender == cvgControlTower.lockingPositionManager().ownerOf(_ownedAndDelegatedTokens.owneds[i]),TOKEN_NOT_OWNED)

Impact

Code Snippet

https://github.com/sherlock-audit/2023-11-convergence/blob/main/sherlock-cvg/contracts/Locking/LockingPositionDelegate.sol#L337-L340

Tool used

Slither
Manual Review

Recommendation

Favor a pull over push strategy for external calls.

[nevillehuang]

Invalid, check required for access control for different tokenIds