Skip to content

Batch Operation Depends on Block Gas Limit

SAFE-0244 Denial of Service Checked automatically by the scanner
1

What goes wrong

A settle/distribute/harvest function must process all outstanding items in a single call. As adoption grows, the required gas eventually exceeds the block limit and the core operation can never run again.

2

The vulnerable pattern

proof of concept — how it is exploited
// harvest() loops all vaults. At 300 vaults it needs 35M gas > block
// limit -> harvest permanently reverts; rewards frozen.
3

How to fix it

the pattern that is safe
// make settlement incremental / paginated with a cursor
function settle(uint256 from, uint256 to) external { for (uint i=from; i<to; ++i) _settle(i); }
Paginate operations that scale with usage.
Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0244 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs