highLogic errorEVM-Solidity
BMX Deli Swap: DoSed `Voter::finalize()` due to unbounded pending removals lacking a batch argument variable
- Payout
- $0
- Protocol
- BMX Deli Swap
- Disclosed
- Sep 16, 2025
- Source
- sherlock
BMX Deli Swap's voter contract finalizes epochs in a batched manner intended to keep reward distribution within a single block's gas budget. However, the internal `_processPendingRemovals()` loop drains the entire pending-removal array with no batch cap. An at …
Similar reports
- No close matches yet.
References
This report is already public and closed. CoinBuggie never publishes active or unpatched vulnerability data.