# denial of service

VUSD.withdraw accepts zero-amount withdrawals, letting an attacker spam the queue so processWithdrawals becomes prohibitively expensive and locks user funds.

- Payout: Audit contest
- Severity: high
- Program: Hubble
- Found by: danb
- Disclosed: 2022-06-02
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-02-hubble-findings/issues/119
- Library page: https://bugbountylibrary.com/r/c4%3A2022-02-hubble%3AH-02
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** VUSD.sol withdraw/processWithdrawals queue
**Root cause:** withdraw() pushes a Withdrawal struct without a minimum amount, so an attacker can enqueue unlimited zero-value entries; processWithdrawals processes a bounded batch per call and never clears entries, so clearing the queue costs gas proportional to the spam.
**Steps:**
1. Attacker calls `withdraw(0)` repeatedly, each call burning 0 and pushing `Withdrawal(msg.sender, 0)` to `withdrawals`.
2. Queue fills with thousands of zero-amount entries.
3. processWithdrawals processes only a limited batch per call and does not clear processed entries, so governance/users must pay gas to walk the whole queue before reaching legitimate withdrawals.
4. Legitimate withdrawals are delayed/locked until the spam is cleared at attacker-comparable gas cost.
**How found:** Code review of VUSD.withdraw and processWithdrawals: noticed no minimum amount check and that the queue is never cleared, making per-call processing cost attacker-controllable.
**Exploitation:** Attacker spends gas to enqueue many zero-amount withdrawals; the protocol must spend equal or greater gas to process them, and if it cannot, user funds remain locked in the queue.
**Insight:** On queue/batch-processing contracts, check whether an unprivileged user can append cheap entries that a privileged processor must later pay to drain; unbounded append + bounded drain is a griefing vector even when each entry is worthless.