# Malicious users can exploit deposit and withdrawal queueing in KangarooVault and LiquidityPool contracts to force exorbitant transaction fees

Attacker queues thousands of 1-wei deposits in Polynomial's LiquidityPool/KangarooVault, forcing later users to pay huge gas to process the sequential queue.

- Payout: Contest reward
- Severity: medium
- Program: Polynomial Protocol
- Credited: bytes032
- Disclosed: 2023-08-01
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-03-polynomial-findings/issues/123
- Library page: https://bugbountylibrary.com/r/c4%3A2023-03-polynomial%3AM-10
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** LiquidityPool and KangarooVault deposit/withdrawal queue processing
**Root cause:** Deposits/withdrawals are processed strictly sequentially from queuedDepositHead, and anyone can enqueue many tiny deposits cheaply, so later users must process the whole backlog to reach their own entry.
**Steps:**
1. Attacker approves sUSD and calls `pool.queueDeposit(1 wei, alice)` in a loop (e.g. 100000 times).
2. Victim calls `pool.queueDeposit(1e18, bob)`.
3. After `minDepositDelay`, victim calls `pool.processDeposits(100001)` to reach their own deposit, paying gas for every attacker entry.
4. Same pattern applies to withdrawals and to KangarooVault when active positions exist.
**How found:** Code review of the queue data structures: noticed queuedDepositHead/nextQueuedDepositId sequential processing and that queueDeposit has no minimum or cancellation, then wrote a Foundry test to measure gas.
**Exploitation:** Attacker spends minimal sUSD (1 wei per entry) to bloat the queue; victims or keepers must iterate the entire queue in processDeposits/processWithdrawals, incurring unbounded gas costs to unlock their funds.
**Escalation:** Scaling to 100,000,000 queued entries yields ~2.4e12 gas, roughly $4M at cited ETH price, effectively locking funds.
**Insight:** When a queue is processed head-to-tail by the caller, check whether entry cost is bounded and whether entries can be cancelled or skipped; a 1-wei entry with no minimum turns the queue into a gas-griefing amplifier.