Infinite loop breaks protocol functionality.
Protocol documentation says that DAO is able to cancel up to 1,000 orders when order count is above 65,000. However, because of the faulty `for loop` it is impossible to cancel more than 255 orders.\\nVulnerability details\\n`orderId` is implemented in protocol to index orders in orderbook. In the protocol documentation it is written that it can handle above 65,000 orders because of reusable orderIds. When there are more than 65,500 orders DAO can cancel up to 1,000 orders. Here are the code blocks from `cancelOrderFarFromOracle` function which allows DAO to cancel orders. It also allows user to cancel one order.\\nIt makes sure that there are more than 65,000 orders.\\n```\\n    if (s.asset[asset].orderId < 65000) {\\n        revert Errors.OrderIdCountTooLow();\\n    }\\n```\\n\\nThis ensures that DAO can't cancel more than 1,000 orders.\\n```\\n     if (numOrdersToCancel > 1000) {\\n        revert Errors.CannotCancelMoreThan1000Orders();\\n    }\\n```\\n\\nLater `cancelOrderFarFromOracle` checks if `msg.sender == LibDiamond.diamondStorage().contractOwner` and based on the boolean value (true or false) of this statement it allows to cancel the desired amount of orders.\\nThe problem occurs in `cancelManyOrders` (LibOrders.sol) which is called on the mapping of orders of specified earlier `orderType`.\\n```\\nfunction cancelManyOrders(\\n        mapping(address => mapping(uint16 => STypes.Order)) storage orders,\\n        address asset,\\n        uint16 lastOrderId,\\n        uint16 numOrdersToCancel\\n    ) internal {\\n        uint16 prevId;\\n        uint16 currentId = lastOrderId;\\n        for (uint8 i; i < numOrdersToCancel;) {\\n            prevId = orders[asset][currentId].prevId;\\n            LibOrders.cancelOrder(orders, asset, currentId);\\n            currentId = prevId;\\n            unchecked {\\n                ++i;\\n            }\\n        }\\n    }\\n    \\n```\\n\\nThis function receives parameters:\\nmapping of orders to cancel\\naddress of asset (market that will be impacted)\\nlast order id\\nnumber of orders to cancel\\nWhen we look at the implementation of this function we can see that `uint8` was used as a variable for the iteration in the `for loop`. `uint8` i maximum value is `255`. As we can see in the `for loop` there is `unchecked` statement which allows uint underflow / overflow.\\n```\\n    unchecked {\\n        ++i;\\n}   \\n```\\n\\nSo when we try to add 1 to 255 (255 + 1) solidity would automaticly `revert` due to uint overflow but when we use `unchecked` solidity allows us to do this operation and the result of this will be `0`.\\nWhen DAO would like to cancel more than 255 orders it would result in infinite loop since:\\nthe for loop will iterate when `i` < numOrdersToCancel\\nthe vaule of `i` will always be less than 256 because it can't get bigger than that due to overflow\\n`i = 255` and `i < 256` `unchecked {++i;}` Next iteration `i = 0` and `i < 256` `unchecked {++i;}`\\nI created pretty simple PoC in Remix.\\n```\\n// SPDX-License-Identifier: MIT\\n\\npragma solidity 0.8.21;\\n\\n\\ncontract PoC {\\n\\n   uint256 public iterationsCount;\\n\\n   function infiniteForLoop(uint256 amountOfIterations) public {\\n      for(uint8 i; i < amountOfIterations;) {\\n         iterationsCount += 1;\\n         unchecked {\\n            ++i;\\n         }\\n      }\\n   }\\n\\n}\\n```\\n\\nTo see that this function can't handle more than 255 orders cancelations run this function with input parameter (amountOfItertions) equal to 256 or above.\\nFurther explenation\\nAfter DAO tries to cancel more than 255 orders the infinite loop will be created which will terminate the transaction.\\nThe transaction will fail because of gas consumption. For loop will run as many times as it can with provided gas. Since it will try to run infinitely it will run out of gas.
To solve this problem change `uint8 i` to `uint16` or any higher uint that can handle the desired amount of iterations.
Protocol documentation states that DAO is able to cancel 1,000 orders. Since it is not possible with the current implementation of the code this issue disrupts protocols functionality. The implemented code can't handle desired functionality.\\nTools used\\nVScode, Manual Review, Remix
```\\n    if (s.asset[asset].orderId < 65000) {\\n        revert Errors.OrderIdCountTooLow();\\n    }\\n```\\n