No deposit is charged for applying on working group role openings

Summary

In the working-group module the apply_on_opening extrinsic does not require a deposit for creating a new role application. Since the working group role applications are stored on-chain, a malicious member could use this extrinsic to exhaust the storage of the blockchain in the case of working group roles that do not require a stake.

Issue

In the working-group module the apply_on_opening has the following issues:

1. There is no upper limit for the number of applications that a single member can submit for an opening
2. Calling this extrinsic is cheap since no deposit is required.

Therefore, a malicious actor can create a lot of applications by calling this extrinsic and consequently fill up the blockchain storage.

Risk

This issue would allow an attacker to fill up the blockchain storage by adding arbitrary number of applications. A full storage is problematic because it could lead to an infeasible amount of storage being required to run a blockchain node.

The severity of this issue depends on the amount of stake required to fill the working group role - it is especially problematic in cases where the opening does not require any stake - thus we consider this issue being of moderate severity.

Mitigation

We suggest to require a deposit for creating working group applications, or alternatively, limit the number of applications per opening_id to 1 from each member_id to prevent attackers from filling up the blockchain storage.

Start at the working-group module's apply_on_opening extrinsic and inspect how role applications are stored and tested. Determine whether the intended protection is a deposit or a per-member limit for each opening_id, then add coverage showing repeated applications cannot exhaust storage.