# Attacker can partially DoS L1 operations in StakingManager by making huge number of deposits

Attacker floods StakingManager's pending deposit queue with minimal stakes so the full-array delete in processL1Operations exceeds block gas limit, blocking L1 processing.

- Payout: Contest reward
- Severity: medium
- Program: Kinetiq
- Credited: givn
- Disclosed: 2025-07-07
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-04-kinetiq#m-05
- Library page: https://bugbountylibrary.com/r/c4%3A2025-04-kinetiq%3AM-05
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:dos

**Target:** StakingManager.sol deposit queue processing (processL1Operations/resetL1OperationsQueue)
**Root cause:** processL1Operations deletes the entire _pendingDeposits array in one transaction once the queue is fully processed; a large array makes the delete exceed the block gas limit.
**Steps:**
1. Attacker obtains HYPE via flash loan.
2. Loop `stakingManager.stake{value: 0.1 ether}()` ~4480 times to fill `_pendingDeposits` with minimal deposits, receiving kHYPE.
3. Sell kHYPE and repay loan.
4. Operator calls `processL1Operations()`; the final `delete _pendingDeposits` exceeds 30M gas and reverts OOG.
5. `resetL1OperationsQueue` also reverts, leaving the last element unprocessable.
**How found:** Code review of the queue-processing logic: noticed the whole `_pendingDeposits` array is deleted at once with no batching, then reasoned that array size is attacker-controllable via cheap minimum stakes and measured gas with a Foundry PoC.
**Exploitation:** Attacker flash-loans HYPE, spams minimum stakes (~0.1 HYPE each, ~4480 deposits, ~$7168 capital) to inflate the queue, sells returned kHYPE to repay, leaving the operator's processL1Operations and resetL1OperationsQueue reverting with OOG.
**Insight:** When a queue/array is cleared with a single `delete`, its length is attacker-influenceable if entries are cheap to add — measure gas of the delete against block gas limit and check whether any reset path also iterates the full array.