executor's execute might be DOSed leading to initaitor losing all transaction gas

[c4-bot-5]

Lines of code

https://github.com/code-423n4/2024-01-decent/blob/011f62059f3a0b1f3577c8ccd1140f0cf3e7bb29/src/UTBExecutor.sol#L70

Vulnerability details

Impact

Medium, tranasaction initiator might lost whole gas while the transaction reverts.

Proof of Concept

executor.execute() is run with extraNative parameter hardocoded to 0, thus the flow of execution is as below:

        uint256 initBalance = IERC20(token).balanceOf(address(this));

        IERC20(token).transferFrom(msg.sender, address(this), amount); 
        IERC20(token).approve(paymentOperator, amount);
        
        (success,) = target.call(payload); // 63/64 of gas is forwarded

        uint256 remainingBalance = IERC20(token).balanceOf(address(this)) - initBalance;

        if (remainingBalance == 0) {
            return;
        }

        IERC20(token).transfer(refund, remainingBalance);

The target.call is perfomed without specifying the gas sent, thus 63/64 of available gas is sent with the call.
In the case of malicous 'target' the whole gas might be spend on this call, while the 1/64 might not be enough to cover the token balanceOF call thus reverting the transaction.
As a result, the transaction initiator lost gas.

Tools Used

VSCode

Recommended Mitigation Steps

• decide on gas limits sent via call, either as protocol setting or function parameter
• do not copy response from call to minimize gas spend, consider using https://github.com/nomad-xyz/ExcessivelySafeCall

Assessed type

Other

[c4-pre-sort]

raymondfam marked the issue as duplicate of #70

[c4-pre-sort]

raymondfam marked the issue as insufficient quality report

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Insufficient proof