Hardcoded Gas Forwarded in External Call

SAFE-0238 External Calls Checked automatically by the scanner

What goes wrong

A call forwards a hardcoded gas amount ({gas: 2300} or a fixed constant). Opcode gas repricing in future hard forks (as happened with EIP-1884) can make that amount insufficient, silently breaking the call.

The vulnerable pattern

proof of concept — how it is exploited

// to.call{gas: 2300, value: v}("");
// after a repricing hard fork, a compliant receive() now costs > 2300
// -> every payout reverts across the protocol.

How to fix it

the pattern that is safe

// forward all remaining gas (default) unless you have a specific reason
(bool ok, ) = to.call{value: amount}("");

◆

Avoid hardcoded gas stipends; they break on repricings.

Where this has happened

Largest recorded losses in the same failure class — related, not the same bug:

$80M · 2022 Fei Protocol / Rari Capital Fuse Reentrancy · 2022 $69.3M · 2023 Curve Finance · Vyper compiler Compiler / toolchain + Reentrancy · 2023 ~$60M · 2016 The DAO Reentrancy · 2016

Related vulnerabilities in External Calls

SAFE-0028Delegatecall to Untrusted / Arbitrary Target critical · External Calls SAFE-0029Arbitrary External Call Injection critical · External Calls SAFE-0026Unchecked Low-Level Call Return Value high · External Calls SAFE-0027Unchecked ERC-20 transfer/transferFrom Return high · External Calls SAFE-0131Unchecked Low-Level Call Return Value high · External Calls SAFE-0310Return Value of send() Ignored high · External Calls SAFE-0092Return Data Length Not Checked (Memory Bomb / Decode Error) medium · External Calls SAFE-0125Return-Data Bomb / Gas Griefing on External Call medium · External Calls

← PreviousRaw returndata Copied / Decoded Unsafely Next →extcodehash / Code Check Bypass Assumptions

Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0238 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs