Below is a vulnerability submitted in an audit contest. I am wondering if this is a legitimate vulnerability.
The reason I am thinking it is not is because it isn't denial of service because, even if an attacker submitted a huge number of shorts to be liquidated, someone else can still call secondaryLiquidation and their call would be processed. It isn't either/or.
Also, wouldn't the attacker bear the cost of all the storage reads? That is a big disincentive.
It's not a legit vulnerability unless liquidateSecondary is called from the codebase indirectly.
The attacker can only burn his own gas if the only entry point is to call this directly.
There is a code comment
If you want to liquidated more than uint88.max worth of erc in shorts, you must call liquidateSecondary multiple times
Yes, it is a vulnerability. The attacker can set high gas price on his transaction and pass huge array as a parameter to the liquidation function. It'll make the contract unresponsive to other users and they may not be able to process liquidations while the attack lasts. And yes, it's expensive, but benefits could outweigh the gas cost.
