Reporting an Attack vector multiple times

[moeid3]

Hi.
I'm glad to ask a question here.
If I see an attack vector multiple times in a base code, should I pack all the attacks in one report or multiple?
for example, if I see a DOS attack in three functions, should I mention these bugs as three high severity in my report or pack them?

[alymurtazamemon]

@moeid3 Good Question!

You need to check the cause of an attack. If the cause is the same then you need to create a single issue and mention all the instances of the code but if the causes are different for each issue then you need to create separate issues.

[moeid3]

I don't understand your explanation.
If there were two different functions like enterRaffle function which are two separate things in puppy raffle( which cuased to an DOS attack)
Should i report twice or attach them into one report?

[alymurtazamemon]

@moeid3 According to this example (enterRaffle function), reading the players' state array can create a DOS issue and stop new players from entering the raffle due to higher gas than the block limit. So, in that case, you will create a single issue stating that 'Users will not be able to enter the raffle because of a DOS issue in the enterRaffle function.'

Now, let's suppose that in the refund function, there would have been a loop as well, and it also would have caused a DOS issue; then, that would have been a separate issue where you would have mentioned an issue like this: 'Users will not be able to get a refund due to a DOS issue in the refund function.

These would have been two different issues unlike both are due to DOS issue.