Skip to content
medium Denial of Service SWC-128 CWE-834

Loop Bound by User-Controlled Length

SAFE-0242 Denial of Service Checked automatically by the scanner
1

What goes wrong

A loop runs for a count taken directly from caller input or from data an attacker can enlarge, with no upper bound. The caller (or a griefer) forces a gas-exhausting or reverting iteration.

2

The vulnerable pattern

proof of concept — how it is exploited
// function process(uint n) external { for (uint i; i<n; ++i) doWork(); }
// process(type(uint).max) -> guaranteed OOG revert; wasted gas / grief.
3

How to fix it

the pattern that is safe
require(n <= MAX_ITER, "too many");
for (uint i; i < n; ++i) { ... }
◆
Bound every externally-influenced loop.
4

Related vulnerabilities in Denial of Service

SAFE-0037DoS via Unexpected Revert in Loop / Push Payments high · Denial of Service SAFE-0038DoS via Unbounded Loop / Gas Exhaustion high · Denial of Service SAFE-0040Locked Ether / No Withdrawal Path high · Denial of Service SAFE-0080Out-of-Gas in Loop Causing Stuck Funds high · Denial of Service SAFE-0124Push-Payment DoS (Loop of External Transfers) high · Denial of Service SAFE-0039Gas Griefing via Subcall Gas Forwarding medium · Denial of Service SAFE-0041Forced Ether Reception Breaking Balance Invariants medium · Denial of Service SAFE-0098Insufficient Withdrawal / Pull Pattern Not Enforced medium · Denial of Service
← PreviousIterating / Deleting Large Storage Mapping-Array
Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0242 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs