Anyone can make creating strategies extremely expensive for the user
In Console architecture, users can deploy spare subaccounts (Gnosis Safes) so that when they will subscribe to a strategy most of the gas spending would have been spent at a low-gas phase.\\n```\\n    function deploySpareSubAccount(address _wallet) external { address subAccount =\\n        SafeDeployer(addressProvider.safeDeployer()).deploySubAccount(_wallet);\\n             subAccountToWalletMap[subAccount] = _wallet; walletToSubAccountMap[_wallet].push(subAccount);\\n           // No need to update subAccountStatus as it is already set to false\\n              emit SubAccountAllocated(_wallet, subAccount);\\n                }\\n```\\n\\nImpact The issue is that anyone can call the deploy function and specify another user's wallet. While on the surface that sounds like donating gas costs, in practice this functionality can make operating with strategies prohibitively expensive. When users will subscribe to strategies, the StrategyRegistry will request a subaccount using this function:\\n```\\n  function requestSubAccount(address _wallet) external returns (address) {\\n      if (msg.sender != subscriptionRegistry) \\n        revert OnlySubscriptionRegistryCallable();\\n          // Try to find a subAccount which already exists\\n           address[] memory subAccountList = walletToSubAccountMap[_wallet];\\n```\\n\\nAt this point, the entire subaccount array will be copied from storage to memory. Therefore, attackers can fill the array with hundreds of elements at a low-gas time and make creation of strategies very difficult.
Limit the amount of spare subaccount to something reasonable, like 10 Team Response: Removing the spare subaccount deployment Mitigation review: Attack surface has been removed.
```\\n    function deploySpareSubAccount(address _wallet) external { address subAccount =\\n        SafeDeployer(addressProvider.safeDeployer()).deploySubAccount(_wallet);\\n             subAccountToWalletMap[subAccount] = _wallet; walletToSubAccountMap[_wallet].push(subAccount);\\n           // No need to update subAccountStatus as it is already set to false\\n              emit SubAccountAllocated(_wallet, subAccount);\\n                }\\n```\\n