# Refunds can be bricked by triggering OOG (out of gas) in DepositManager

Unbounded deposit array in BountyCore.getLockedFunds causes out-of-gas in DepositManager.refundDeposit, permanently locking refunds.

- Payout: Contest reward
- Severity: high
- Program: Openq
- Credited: clems4ever
- Disclosed: 2023-01-30
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-openq-judging/issues/77
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-openq%3AH-7
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:dos

**Target:** DepositManagerV1.refundDeposit / BountyCore.getLockedFunds
**Root cause:** getLockedFunds iterates over the entire unbounded deposits array; receiveFunds imposes no cap on deposit count, so the loop can exceed block gas limit.
**Steps:**
1. Call receiveFunds repeatedly on a bounty to append many entries to the deposits array (no limit enforced).
2. Call refundDeposit on that bounty; it invokes getLockedFunds which loops over all deposits.
3. With enough deposits the loop exceeds block gas limit, reverting with OOG and blocking all refunds.
**How found:** Code reading of refundDeposit traced into getLockedFunds, noticing a for loop over an array whose length is set by an uncapped receiveFunds.
**Exploitation:** Attacker (or any funder) inflates the bounty's deposit array via many receiveFunds calls; subsequent refundDeposit calls always revert OOG, locking deposited funds in the contract.
**Insight:** When auditing refund/withdrawal paths, trace every loop bound back to its writer; any user-growable array iterated in a value-moving function is a gas-griefing lock vector.