Description

The _cleanupMaturedBuckets function may run out of gas if too many days have elapsed since the last lastMatured update.

function _cleanupMaturedBuckets(uint256 duration) internal {
    uint256 lastMatured = lastMaturedDate[duration];
    uint256 currentDate = (block.timestamp / 1 days) * 1 days;

    // [...]

    for (uint256 date = lastMatured; date <= currentDate; date += 1 days) {
        MaturityBucket storage bucket = maturityBuckets[duration][date];
        if (bucket.totalLiquidity > 0) {
            mature(duration, date);
        }
    }

    // [...]
}

Impact

If the last lastMatured update was too long ago, the function using _cleanupMaturedBuckets (i.e., depositReward) may revert due to an out-of-gas error.

Recommendations

To prevent excessive looping, impose a maximum loop limit to restrict the number of loops.

Remediation

Falcon provided the following response:

In the real world we will be calling depositRewards on a daily basis.