Skip to content
medium Denial of Service SWC-128 CWE-400

Unbounded Batch Mint / Airdrop Loop

SAFE-0214 Denial of Service Checked automatically by the scanner
1

What goes wrong

A mint/airdrop iterates a caller-supplied array with no length cap. A large array runs out of gas (blocking the operation) or, combined with per-item accounting, inflates supply unexpectedly.

2

The vulnerable pattern

proof of concept — how it is exploited
// airdrop(bigArray) with 5000 entries -> exceeds block gas limit,
// the tx always reverts; or a cheaper griefer forces others' batches
// to compete for gas.
3

How to fix it

the pattern that is safe
require(recipients.length <= MAX_BATCH, "batch too large");
for (uint i; i < recipients.length; ++i) { _mint(recipients[i], amount); }
◆
Cap batch sizes for any loop over external input.
4

Related vulnerabilities in Denial of Service

SAFE-0037DoS via Unexpected Revert in Loop / Push Payments high · Denial of Service SAFE-0038DoS via Unbounded Loop / Gas Exhaustion high · Denial of Service SAFE-0040Locked Ether / No Withdrawal Path high · Denial of Service SAFE-0080Out-of-Gas in Loop Causing Stuck Funds high · Denial of Service SAFE-0124Push-Payment DoS (Loop of External Transfers) high · Denial of Service SAFE-0039Gas Griefing via Subcall Gas Forwarding medium · Denial of Service SAFE-0041Forced Ether Reception Breaking Balance Invariants medium · Denial of Service SAFE-0098Insufficient Withdrawal / Pull Pattern Not Enforced medium · Denial of Service
← Previousextcodesize == 0 Used as EOA Check (Bypassable)
Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0214 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs