Orbiting Rosewood Swallow - Blacklisted USDT user can cause DOS for all

[sherlock-admin3]

Orbiting Rosewood Swallow

Medium

Blacklisted USDT user can cause DOS for all

Summary

A malicious Blacklisted USDT user can cause DOS for all

Impact

Let's say a malicious user has a lot of tokens (may be hacked tokens) and has the intention to stop Oku's functionality for other users. Or he has the intention to harm other protocols.

• Currently, he is not blacklisted on USDT but his bad action over other protocols will later add him as a blacklisted user.

Now when he is not blacklisted he creates a lot of orders on Oku's contracts.

Later because of his malicious actions / may be hacked into other protocol, and his account has been added as a blacklisted user.

• Because he has created a lot of orders so when a normal user will go to Oku's fillOrder or cancleOrder function they have to iterate a huge array because ArrayMutation.removeFromArray is called on those functions.

• Now they will simply run out off gas because of iterating on huge array.

• So all user get permanent DOS

• Admin even can not cancleOrder for him because he is blacklisted and canceling order will try be sent him his token and will fail. Or have to iterate on large Array

PoC

Bracket::createOrder

    function createOrder(
        bytes calldata swapPayload,
        uint256 takeProfit,
        uint256 stopPrice,
        uint256 amountIn,
        IERC20 tokenIn,
        IERC20 tokenOut,
        address recipient,
        uint16 feeBips,
        uint16 takeProfitSlippage,
        uint16 stopSlippage,
        bool permit,
        bytes calldata permitPayload
    ) external override nonReentrant {
        _initializeOrder(
            swapPayload,
            takeProfit,
            stopPrice,
            amountIn,
            0, //no existing order id
            tokenIn,
            tokenOut,
            recipient,
            feeBips,
            takeProfitSlippage,
            stopSlippage,
            permit,
            permitPayload
        );
    }

It is possible even from the createOrder function of OracleLess, StopLimit

Mitigation

Implement logic so that a blacklisted USDT user can not interrupt calling fillOrder, cancleOrder functions.