MEDIUM severity: The vulnerability lies in the `TellerV2#submitBid()` function, which allows a borrower to assign an . The vulnerability lies in the `TellerV2#submitBid()` function, which allows a borrower to assign an unlimited number of collateral assets to the `_collateralInfo` array parameter. This lack of limitation can lead to a scenario where a borrower assigns an excessive number of collateral assets, causin...

Vulnerable code:
```\nstruct Collateral {\n    CollateralType _collateralType;\n    uint256 _amount;\n    uint256 _tokenId;\n    address _collateralAddress;\n}\n```\n```\nstruct CollateralInfo {\n    EnumerableSetUpgradeable.AddressSet collateralAddresses;\n    mapping(address => Collateral) collateralInfo;\n}\n```\n```\nmapping(uint256 => CollateralInfo) internal _bidCollaterals;\n```\n```\nfunction submitBid(\n    address _lendingToken,\n    uint256 _marketplaceId,\n    uint256 _principal,\n    uint32 _duration,\n    uint16 _APR,\n    string calldata _metadataURI,\n    address _receiver,\n    Collateral[] calldata _collateralInfo\n) public override whenNotPaused returns (uint256 bidId_) {\n    bool validation = collateralManager.commitCollateral(\n        bidId_,\n        _collateralInfo\n    );\n```\n```\n/**\n * @notice Checks the validity of a borrower's multiple collateral balances and commits it to a bid.\n * @param _bidId The id of the associated bid.\n * @param _collateralInfo Additional information about the collateral assets.\n * @return validation_ Boolean indicating if the collateral balances were validated.\n */\nfunction commitCollateral(\n    uint256 _bidId,\n    Collateral[] calldata _collateralInfo\n) public returns (bool validation_) {\n    address borrower = tellerV2.getLoanBorrower(_bidId);\n    (validation_, ) = checkBalances(borrower, _collateralInfo);\n\n    if (validation_) {\n        for (uint256 i = 0; i < _collateralInfo.length; i++) {\n            Collateral memory info = _collateralInfo[i];\n            _commitCollateral(_bidId, info);\n        }\n    }\n}\n```\n```\n/**\n * @notice Checks the validity of a borrower's collateral balance and commits it to a bid.\n * @param _bidId The id of the associated bid.\n * @param _collateralInfo Additional information about the collateral asset.\n */\nfunction _commitCollateral(\n    uint256 _bidId,\n    Collateral memory _collateralInfo\n) internal virtual {\n    CollateralInfo storage collateral = _bidCollaterals[_bidId];\n    collateral.collateralAddresses.add(_collateralInfo._collateralAddress);\n    collateral.collateralInfo[_collateralInfo._collateralAddress] = _collateralInfo;\n}\n```\n```\n/**\n * @notice Withdraws deposited collateral from the created escrow of a bid that has been successfully repaid.\n * @param _bidId The id of the bid to withdraw collateral for.\n */\nfunction withdraw(uint256 _bidId) external {\n    BidState bidState = tellerV2.getBidState(_bidId);\n    if (bidState == BidState.PAID) {\n        _withdraw(_bidId, tellerV2.getLoanBorrower(_bidId));\n    } else if (tellerV2.isLoanDefaulted(_bidId)) {\n        _withdraw(_bidId, tellerV2.getLoanLender(_bidId));\n    }\n```\n```\n/**\n * @notice Sends the deposited collateral to a liquidator of a bid.\n * @notice Can only be called by the protocol.\n * @param _bidId The id of the liquidated bid.\n * @param _liquidatorAddress The address of the liquidator to send the collateral to.\n */\nfunction liquidateCollateral(uint256 _bidId, address _liquidatorAddress)\n    external\n    onlyTellerV2\n{\n    if (isBidCollateralBacked(_bidId)) {\n        BidState bidState = tellerV2.getBidState(_bidId);\n        require(\n            bidState == BidState.LIQUIDATED,\n            "Loan has not been liquidated"\n        );\n        _withdraw(_bidId, _liquidatorAddress);\n    }\n}\n```\n```\n/**\n * @notice Withdraws collateral to a given receiver's address.\n * @param _bidId The id of the bid to withdraw collateral for.\n * @param _receiver The address to withdraw the collateral to.\n */\nfunction _withdraw(uint256 _bidId, address _receiver) internal virtual {\n    for (uint256 i = 0; i < _bidCollaterals[_bidId].collateralAddresses.length(); i++) {\n        // Get collateral info\n        Collateral storage collateralInfo = _bidCollaterals[_bidId].collateralInfo[_bidCollaterals[_bidId].collateralAddresses[i]];\n        // Withdraw collateral from escrow and send it to bid lender\n        ICollateralEscrowV1(_escrows[_bidId]).withdraw(\n            collateralInfo._collateralAddress,\n            collateralInfo._amount,\n            _receiver\n        );\n    }\n```