# gas limit DoS via unbounded operations

Attacker floods a borrower's vouchers array with zero-amount vouches, making updateLocked and registerMember loops unbounded and causing gas-limit DoS on borrow/repay.

- Payout: Contest reward
- Severity: medium
- Program: Union Finance
- Credited: Ch_301
- Disclosed: 2022-11-04
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-10-union-finance-judging/issues/69
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-union-finance%3AM-11
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:dos

**Target:** UserManager.sol / UToken.sol smart contracts
**Root cause:** updateTrust pushes a Vouch entry for every vouch call without rejecting trustAmount==0, so an attacker can append unlimited entries to vouchers[borrower]; updateLocked and registerMember then iterate the whole array, exceeding block gas limit.
**Steps:**
1. Attacker (member) repeatedly calls `updateTrust(alice, 0)` to push `Vouch(staker, 0, 0, 0)` into `vouchers[alice]` many times.
2. Array grows large (e.g. 20% of max uint) at attacker's gas cost.
3. Alice calls `borrow()`/`repayBorrow()` on UToken, which calls `updateLocked(alice, amount, ...)` looping over `vouchers[alice]`.
4. Loop exceeds block gas limit, reverting the transaction.
5. Similarly `registerMember(alice)` loops over vouchers and reverts, blocking membership.
**How found:** Code review of updateTrust's unbounded push into vouchers[] combined with the for-loops in updateLocked and registerMember; noted zero trustAmount is accepted, allowing cheap array inflation.
**Exploitation:** Attacker pays gas to spam zero-value vouch entries against a victim, permanently (or until cleanup) making borrow/repay/registerMember revert out-of-gas, locking the victim out of lending operations.
**Insight:** Look for arrays appended to by unprivileged callers that are later iterated in state-changing functions; zero/dust-amount entries are a cheap way to inflate them since the attacker only pays gas.