Consider adding a vault limit for accounts

[0x-r4bbit]

There's a couple of places where the protocol has to iterate over account vaults:

staking-reward-streamer/src/RewardsStreamerMP.sol

Lines 142 to 151 in e3d50bf

	function mpBalanceOfAccount(address account) external view returns (uint256) {
	address[] memory accountVaults = vaults[account];
	uint256 accountTotalMP = 0;
	for (uint256 i = 0; i < accountVaults.length; i++) {
	VaultData storage vault = vaultData[accountVaults[i]];
	accountTotalMP += vault.mpAccrued + _getVaultPendingMP(vault);
	}
	return accountTotalMP;
	}

staking-reward-streamer/src/RewardsStreamerMP.sol

Lines 159 to 167 in e3d50bf

	function getAccountTotalMaxMP(address account) external view returns (uint256) {
	address[] memory accountVaults = vaults[account];
	uint256 accountTotalMaxMP = 0;
	for (uint256 i = 0; i < accountVaults.length; i++) {
	accountTotalMaxMP += vaultData[accountVaults[i]].maxMP;
	}
	return accountTotalMaxMP;
	}

staking-reward-streamer/src/RewardsStreamerMP.sol

Lines 175 to 183 in e3d50bf

	function getAccountTotalStakedBalance(address account) external view returns (uint256) {
	address[] memory accountVaults = vaults[account];
	uint256 accountTotalStake = 0;
	for (uint256 i = 0; i < accountVaults.length; i++) {
	accountTotalStake += vaultData[accountVaults[i]].stakedBalance;
	}
	return accountTotalStake;
	}

staking-reward-streamer/src/RewardsStreamerMP.sol

Lines 522 to 531 in e3d50bf

	function rewardsBalanceOfAccount(address account) external view returns (uint256) {
	address[] memory accountVaults = vaults[account];
	uint256 accountTotalRewards = 0;
	for (uint256 i = 0; i < accountVaults.length; i++) {
	accountTotalRewards += rewardsBalanceOf(accountVaults[i]);
	}
	return accountTotalRewards;
	}

In theory a malicious account can create many vaults which could cause these functions to run out of gas (yes, gas limits exist for view functions on third party node providers).

Accounts would likely only harm themselves (in the worst case they wouldn't be able to retrieve their balances), but we should probably still do whatever makes most sense.

Creating vaults has become cheap and easy ever since we moved to proxy clones. While it's unlikely that users will create hundreds of vaults, it's still possible.

We can avoid this by simply setting a limit for how many vaults an account can create.

[0x-r4bbit]

Discussed this further offline with @gravityblast
Adding a limit adds some additional complexity with regards to vault migration because one could reach the vault limit and be unable to create new vaults for migration (which might be necessary after an upgrade).

This is solvable by deregistering an old vault after migrating.

Anyways, we've concluded that it's not worth it given the likelihood of this issue.

If this does become an issue in the future we can easily fix this with an upgrade.