# DoS of lenders and gas griefing by packing tokenIdToBorrowingKeys arrays

Unbounded tokenIdToBorrowingKeys array in LiquidityBorrowingManager lets an attacker spam tiny borrows to gas-grief and DoS repay/liquidation of an LP position, locking lender liquidity.

- Payout: Contest reward
- Severity: medium
- Program: Real Wagmi
- Credited: 0xDetermination
- Disclosed: 2023-10-07
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-10-real-wagmi-judging/issues/15
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-10-real-wagmi%3AM-1
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** LiquidityBorrowingManager / Keys library (Solidity lending contract)
**Root cause:** tokenIdToBorrowingKeys[tokenId] is an unbounded array iterated linearly by addKeyIfNotExists/removeKey on every borrow, repay, and liquidation, so each added key raises gas cost of all exit paths.
**Steps:**
1. LP authorizes a large position (e.g. USDC/WETH) to the contract.
2. Attacker takes minimum borrows (MINIMUM_BORROWED_AMOUNT=100000, ~$0.1 USDC) from many addresses, each pushing a new borrowingKey into tokenIdToBorrowingKeys[tokenId].
3. Repeat until array length makes repay/liquidation/takeOverDebt exceed block gas limit (~15,000 keys at ~2000 gas each).
4. Attacker opens a high-leverage borrow on the same LP position; it cannot be repaid or liquidated.
5. Attacker periodically calls increaseCollateralBalance() on spam positions to avoid liquidation, keeping the array long.
**How found:** Code review of _addKeysAndLoansInfo and Keys library revealed linear iteration over an unbounded, attacker-growable array on all exit paths; attacker cost modeled against EIP-2929 SLOAD gas.
**Exploitation:** Attacker spends ~$60k spamming minimum borrows to pack the array, then opens a $1M borrow against $20k collateral; total ~$95k locks $1M of lender liquidity for years since repay/liquidation iterate the packed array and revert out-of-gas.
**Escalation:** Sustained collateral top-ups on spam positions prevent array shortening via liquidation, extending DoS arbitrarily; raising interest rates to counter hurts all market users.
**Insight:** Any per-token array that grows with each new borrower and is linearly scanned on repay/liquidation is a gas-griefing DoS vector; check whether minimum borrow amounts make array-packing cheaper than the value it locks.