OpenAgents

If the array size is influenced by users (e.g. dynamic list of depositors, addresses, tokens), an attacker or heavy usage can make the array grow, locking the protocol's key functions permanently.

Line 109 contains a `for` loop that appears to iterate over the length of a dynamic array. If the array grows too large, the gas cost to execute the loop will exceed the block gas limit, causing the function to become permanently unusable.

Vulnerable Code

107      106 |     /// @return True if the combined weight meets or exceeds the threshold.
108      107 |     function hasConsensus(address[] calldata signers) external view returns (bool) {
109      108 |         uint256 weightSum = 0;
110 >>>  109 |         for (uint256 i = 0; i < signers.length; i++) {
111      110 |             if (validators[signers[i]].isActive) {
112      111 |                 weightSum += validators[signers[i]].weight;
113      112 |             }

Avoid iterating over unbounded dynamic arrays. Instead, use a pull-payment pattern or implement pagination so the loop can be processed in smaller, bounded chunks.