Skip to content

Revert Reason Griefing / Return Bomb in Loop

SAFE-0243 Denial of Service Checked automatically by the scanner
1

What goes wrong

A loop makes external calls and bubbles up the raw revert reason (or copies returndata). A malicious callee returns a huge revert payload, inflating the caller's gas and potentially reverting the whole batch.

2

The vulnerable pattern

proof of concept — how it is exploited
// for each t: t.call(data) and revert(returndata) on failure.
// one t returns a 1MB revert reason -> the batch pays quadratic memory
// gas and reverts for everyone.
3

How to fix it

the pattern that is safe
// use a bounded/low-level call that ignores returndata size
(bool ok, ) = target.call{gas: 50000}(data);
if (!ok) { /* record and continue, don't bubble raw returndata */ }
Bound gas and don't bubble untrusted returndata.
Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0243 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs