Margin callers can drain the TAPP during liquidation by willingly increase gas costs with the shortHintArray
During primary liquidation the TAPP (Treasury Asset Protection Pool) pays the gas costs of force bids, so that margin callers are even motivated to liquidate shorters, if gas costs are high. To liquidate a shortRecord margin, callers must provide a parameter called shortHintArray to the function call. The purpose of this array is to save gas, it should contain id hints where the protocol should look for shorts in the order book which are currently above the oracle price, since users can't match against shorts under the oracle price. As the protocol loops through this shortHintArray, an array with wrong hints could increase gas and as the length of the array is never checked, it could even increase the gas costs to an amount that would fully drain the TAPP. As the TAPP is an important security mechanism of the protocol, draining the funds of it could lead to a shutdown of the market and therefore to a big loss of user funds.\\nThe liquidate function takes the shortHintArray as parameter:\\n```\\nfunction liquidate(\\n    address asset,\\n    address shorter,\\n    uint8 id,\\n    uint16[] memory shortHintArray\\n)\\n    external\\n    isNotFrozen(asset)\\n    nonReentrant\\n    onlyValidShortRecord(asset, shorter, id)\\n    returns (uint88, uint88)\\n{\\n// rest of code\\n}\\n```\\n\\nThis array is then used to create a forceBid:\\n```\\n(m.ethFilled, ercAmountLeft) = IDiamond(payable(address(this))).createForcedBid(\\n    address(this), m.asset, _bidPrice, m.short.ercDebt, shortHintArray\\n);\\n```\\n\\nAnd during these process, the protocol loops over this array:\\n```\\nfunction _updateOracleAndStartingShort(address asset, uint16[] memory shortHintArray)\\n    private\\n{\\n  // rest of code\\n  uint16 shortHintId;\\n  for (uint256 i = 0; i < shortHintArray.length;) {\\n    shortHintId = shortHintArray[i];\\n    unchecked {\\n        ++i;\\n    }\\n\\n    {\\n        O shortOrderType = s.shorts[asset][shortHintId].orderType;\\n        if (\\n            shortOrderType == O.Cancelled || shortOrderType == O.Matched\\n                || shortOrderType == O.Uninitialized\\n        ) {\\n            continue;\\n        }\\n    }\\n  // rest of code\\n}\\n```\\n\\nIn the end, the TAPP pays for the gas costs in the _marginFeeHandler function:\\n```\\nfunction _marginFeeHandler(MTypes.MarginCallPrimary memory m) private {\\n    STypes.VaultUser storage VaultUser = s.vaultUser[m.vault][msg.sender];\\n    STypes.VaultUser storage TAPP = s.vaultUser[m.vault][address(this)];\\n    // distribute fees to TAPP and caller\\n    uint88 tappFee = m.ethFilled.mulU88(m.tappFeePct);\\n    uint88 callerFee = m.ethFilled.mulU88(m.callerFeePct) + m.gasFee;\\n\\n    m.totalFee += tappFee + callerFee;\\n    //@dev TAPP already received the gasFee for being the forcedBid caller. tappFee nets out.\\n    if (TAPP.ethEscrowed >= callerFee) {\\n        TAPP.ethEscrowed -= callerFee;\\n        VaultUser.ethEscrowed += callerFee;\\n    } else {\\n        // Give caller (portion of?) tappFee instead of gasFee\\n        VaultUser.ethEscrowed += callerFee - m.gasFee + tappFee;\\n        m.totalFee -= m.gasFee;\\n        TAPP.ethEscrowed -= m.totalFee;\\n    }\\n}\\n```\\n\\nTherefore, if the user provides a big shortHintArray with wrong hints the gas costs will drastically increase to a point which drains the funds of the TAPP.
Check the length of the shortHintArray.
As the TAPP does no longer has enough funds to pay for liquidation, if shortRecords are under collateralized. A lot of problems like the increment of the ercDebtRate and the shutdown of the market can occur. This leads to a big loss of user funds.
```\\nfunction liquidate(\\n    address asset,\\n    address shorter,\\n    uint8 id,\\n    uint16[] memory shortHintArray\\n)\\n    external\\n    isNotFrozen(asset)\\n    nonReentrant\\n    onlyValidShortRecord(asset, shorter, id)\\n    returns (uint88, uint88)\\n{\\n// rest of code\\n}\\n```\\n