# Malicious user can make rolloverQueue never get processed

Shared rolloverQueue across epochs lets an attacker spam min-deposit entries, bloating queue so relayers never profitably call mintRollovers, permanently DoSing rollovers.

- Payout: Contest reward
- Severity: medium
- Program: Y2K
- Credited: Ace-30
- Disclosed: 2023-03-06
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-03-Y2K-judging/issues/172
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-03-Y2K%3AM-5
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Carousel.sol rolloverQueue / mintRollovers
**Root cause:** rolloverQueue is a single array shared across all epochs; mintRollovers iterates from the start each round, so entries that never delist accumulate and inflate per-round gas.
**Steps:**
1. Attacker holds balanceOf(bob,E1)=1000e18 and creates 1000 addresses.
2. For each address: `Carousel.safeTransferFrom(bob, addr, E1, 1e18)` then `Carousel.enlistInRollover(E1, 1e18, addr)` with 1e18 = minRequiredDeposit.
3. rolloverQueue.length becomes 1010 (1000 spam + 10 legit).
4. Spam addresses never call `delistInRollover`, so items persist every epoch.
5. Relayer must process 1000+ useless items per round; executions don't increase so relayerFee is not paid, making mintRollovers unprofitable.
**How found:** Code reading of mintRollovers loop over a global rolloverQueue and the relayerFee tied to executions; noticed queue is shared across epochs and entries only removed via user-initiated delistInRollover.
**Exploitation:** Attacker spends minRequiredDeposit per address once, then abandons them; queue grows permanently and relayers refuse to call mintRollovers, halting rollover processing for all users.
**Insight:** When a relayer/incentive loop iterates a global array whose entries are only removed by user action, check whether an attacker can cheaply add entries that never get cleaned up and dilute the per-item reward below gas cost.