# Block usage of addCuratedPool

Unbounded arrayPools growth makes curatedPoolCount() loop run out of gas, permanently blocking DAO addCuratedPool() calls.

- Payout: Audit contest
- Severity: medium
- Program: Spartan Protocol
- Found by: gpersoon
- Disclosed: 2021-09-16
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-07-spartan-findings/issues/6
- Library page: https://bugbountylibrary.com/r/c4%3A2021-07-spartan%3AM-11
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:dos

**Target:** PoolFactory / Pool smart contracts (Solidity)
**Root cause:** curatedPoolCount() iterates the entire arrayPools array; arrayPools grows without bound because createPoolADD pushes and Pool.remove() lets the creator reclaim liquidity, so the loop eventually exceeds block gas limit and reverts.
**Steps:**
1. Call `createPoolADD(inputBase, inputToken, token)` with `inputBase >= 10000*10**18` and a fresh 18-decimal token to push a new pool onto `arrayPools`.
2. Call `remove()` on the new Pool to reclaim SPARTA/token liquidity.
3. Repeat until `arrayPools.length` is large enough that `curatedPoolCount()`'s for-loop exceeds block gas limit.
4. DAO `addCuratedPool()` now reverts on `require(curatedPoolCount() < curatedPoolSize)`.
**How found:** Code review of curatedPoolCount()'s unbounded for-loop over arrayPools combined with noticing createPoolADD pushes to arrayPools and Pool.remove() refunds liquidity, enabling cheap repeated growth.
**Exploitation:** Attacker repeatedly creates and drains pools, paying gas each cycle, to inflate arrayPools until curatedPoolCount() is uncallable within a block; DAO can no longer add curated pools.
**Insight:** Look for view/count helpers that loop over arrays which any user can append to and later shrink/refund; a push-with-refund cycle turns a bounded array into a gas-griefing DoS on privileged functions that call the loop.