Skip to content

Return-Data Bomb / Gas Griefing on External Call

SAFE-0125 External Calls Checked automatically by the scanner
1

What goes wrong

A low-level call copies unbounded return data into memory. A malicious callee returns a huge byte array, forcing the caller to pay quadratic memory-expansion gas and potentially revert — griefing any flow that calls into an attacker-chosen address.

2

The vulnerable pattern

proof of concept — how it is exploited
// contract Bomb { fallback() external { assembly { return(0, 3000000) } } }
// caller: target.call(data) copies 3MB of returndata -> OOG revert / grief.
3

How to fix it

the pattern that is safe
// assembly call that ignores returndata, or a bounded gas stipend
(bool ok,) = target.call{gas: 100000}(data);
// with inline asm: call(gas, target, 0, in, insize, 0, 0)  // out=0
Bound gas and ignore returndata for untrusted calls.
Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0125 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs