# Adverary can DOS contract by making a large number of deposits/withdraws then removing them all

Dequeued deposits/withdraws leave zero-amount entries in CrabNetting's queue; an adversary spams deposits then dequeues them, bloating the array so auction processing exceeds block gas limit and permanently DOSes the contract.

- Payout: Contest reward
- Severity: high
- Program: Opyn
- Credited: indijanc
- Disclosed: 2022-11-22
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2022-11-opyn-judging/issues/148
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-11-opyn%3AH-3
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** CrabNetting.sol deposit/withdraw queue processing loop
**Root cause:** Dequeuing a deposit/withdraw sets its amount to zero but leaves the array entry in place; the processing loop iterates over every entry, reading and skipping blanks, so gas cost scales with total historical entries rather than active quantity.
**Steps:**
1. Adversary repeatedly calls deposit then dequeue (or withdraw then dequeue) to append many entries to the deposits/withdraws array, each ending as amount==0.
2. Each blank entry remains in storage; the while loop in _processDeposits reads `deposits[i]`, sees amount==0, increments i and continues, consuming gas per blank.
3. Repeat until the array length makes any call to the auction/netting processing loop exceed the block gas limit.
4. Any subsequent auction fill or netting call reverts out-of-gas, permanently blocking processing.
**How found:** Code review of the deposit-processing loop: noticed dequeued entries are zeroed but not removed, and the loop still reads/skips each blank entry, implying gas scales with stale entries — a griefing vector.
**Exploitation:** Attacker with minimal capital spams deposit/dequeue cycles to grow the queue with zero-amount entries; since processing is fill-or-kill over the whole array, the loop can never complete within block gas limits, halting auctions and netting.
**Insight:** When a queue uses delete/zeroing instead of compaction, check whether iteration cost scales with historical entries; any user-writable append+dequeue path becomes a cheap gas-griefing DOS on the whole processing loop.