Skip to content

Latest commit

 

History

History
40 lines (20 loc) · 954 Bytes

089.md

File metadata and controls

40 lines (20 loc) · 954 Bytes

Damp Ivory Aphid

Medium

Medium Multiple lenders can't claim their incentives.

Summary

Multiple lenders performing DDoS attacks on DebitaIncentives::ClaimIncentives will cause other users to be unable to claim their incentives.

Root Cause

in "DebitaIncentives.sol"L142 claimIncentives has no restrictions over each lender or borrower ID

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

Multiple lenders with different wallet addresses, who have engaged in lending and borrowing activities at a specific epoch time, can collectively launch a DDoS attack to prevent other users from claiming incentives before the deadline.

PoC

No response

Mitigation

use Access control checks for lenders or borrowers.