# Array Length of tickTracking_  can be purposely increased to Brick Minting and Burning of most users' liquidity positions

Attacker spams tiny swaps across a tick boundary to grow tickTracking_ array, causing gas-limit reverts in accrueConcentratedPositionTimeWeightedLiquidity and bricking mint/burn/harvest for most LPs.

- Payout: Contest reward
- Severity: high
- Program: Canto
- Credited: Banditx0x
- Disclosed: 2023-11-20
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-10-canto-findings/issues/114
- Library page: https://bugbountylibrary.com/r/c4%3A2023-10-canto%3AH-01
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:dos

**Target:** Ambient concentrated liquidity pool LiquidityMining.sol (accrueConcentratedPositionTimeWeightedLiquidity / crossTicks)
**Root cause:** crossTicks pushes a new TickTracking entry on every tick crossing, even when entry and exit occur in the same block (zero time delta), and accrueConcentratedPositionTimeWeightedLiquidity loops over the entire tickTracking_ array unbounded.
**Steps:**
1. Identify a tick near a stable pool price (e.g. USDC/USDT ~$1) that is always reward-eligible.
2. Swap to move price very close to the tick boundary.
3. Execute many extremely small swaps bouncing price back and forth across the boundary, each calling crossTicks and pushing a new tickTracking_ entry.
4. Repeat until tickTracking_[poolIdx][tick].length is large enough that the while loop in accrueConcentratedPositionTimeWeightedLiquidity exceeds block gas limit.
5. Any user minting, burning, or harvesting a position spanning that tick now reverts.
**How found:** Code review of crossTicks and the unbounded while loop over tickTracking_ in accrueConcentratedPositionTimeWeightedLiquidity; noted same-block crossings still push entries despite zero time delta, and that stable pools concentrate eligible ticks near a predictable price.
**Exploitation:** Attacker pays only swap gas to inflate the array; subsequent mint/burn/harvest calls by nearly all LPs revert on gas, effectively DoSing concentrated liquidity functionality.
**Escalation:** Targeting one or two ticks near a pegged price affects almost every user's position rather than only wide ranges.
**Insight:** Look for unbounded arrays appended on every state transition (including no-op same-block transitions) that are later iterated in user-facing paths; predictable pegged prices let an attacker target a single hot tick to grief all users cheaply.