# Whitelisted accounts can be forcefully DoSed from buying curveTokens during the presale

Anyone can transfer dust curveTokens of junk subjects to a whitelisted account, permanently bloating its ownedCurvesTokenSubjects array until presale buys revert out-of-gas.

- Payout: Contest reward
- Severity: high
- Program: Curves Protocol
- Credited: 0xStalin
- Disclosed: 2024-07-19
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-01-curves-findings/issues/1068
- Library page: https://bugbountylibrary.com/r/c4%3A2024-01-curves%3AH-01
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:dos

**Target:** Curves.sol presale buy / _addOwnedCurvesTokenSubject
**Root cause:** _addOwnedCurvesTokenSubject iterates a storage array that only ever grows (no pop on sell/transfer-out) and is appended to on any inbound transfer, so a third party can inflate a victim's array without consent.
**Steps:**
1. Attacker creates many junk curveToken subjects (random accounts).
2. Attacker buys 1 curveToken of each junk subject from a single account.
3. Attacker calls `transferAllCurvesTokens(victim)` where victim is a whitelisted presale participant; `_transfer` calls `_addOwnedCurvesTokenSubject(victim, junkSubject)` for each.
4. Victim's `ownedCurvesTokenSubjects[victim]` grows unbounded; no pop exists on sell/transfer-out.
5. Victim calls `buyCurvesTokenWhitelisted()`; `_buyCurvesToken` -> `_addOwnedCurvesTokenSubject` loops the huge storage array and reverts out-of-gas.
**How found:** Code reading of _buyCurvesToken/_transfer/_addOwnedCurvesTokenSubject: noticed the storage-array loop, that entries are never removed, and that inbound transfers let arbitrary third parties append to a victim's array.
**Exploitation:** Attacker needs only dust curveTokens of self-created junk subjects; a single transferAllCurvesTokens call mass-appends junk subject addresses to the victim's array, permanently blocking the victim from buying during the presale.
**Insight:** Look for per-user storage arrays that are appended on inbound transfers (not just self-initiated actions) and never pruned; such arrays are griefing/DoS vectors because an attacker can grow a victim's state without their consent.