Skip to content
medium Logic / State SWC-132 CWE-697

Strict address(this).balance Equality (Force-Feed)

SAFE-0251 Logic / State Checked automatically by the scanner
1

What goes wrong

Logic relies on an exact this.balance value (== or an invariant that the balance only changes via the contract's own functions). Ether can be force-fed via selfdestruct or a coinbase payment, breaking the equality and locking or mis-routing funds.

2

The vulnerable pattern

proof of concept — how it is exploited
// require(address(this).balance == expected);
// attacker selfdestructs a contract sending 1 wei to this address
// -> balance != expected forever -> the function is bricked.
3

How to fix it

the pattern that is safe
// track deposited value in a storage variable; never assume this.balance
uint256 internal _accounted;   // update on deposit/withdraw
◆
Never assume this.balance only changes via your code.
4

Where this has happened

Largest recorded losses in the same failure class — related, not the same bug:

$586M · 2022 BNB Chain Token Hub Input validation · 2022 $326M · 2022 Wormhole Input validation · 2022 $197M · 2023 Euler Finance Input validation · 2023 $190M · 2022 Nomad Bridge Input validation · 2022
5

Related vulnerabilities in Logic / State

SAFE-0071Incorrect Accounting / Internal Balance Drift high · Logic / State SAFE-0095Uninitialized Storage Pointer (legacy) high · Logic / State SAFE-0146msg.value Reused Across a Loop / Multicall high · Logic / State SAFE-0249Missing Claimed Flag — Double Claim high · Logic / State SAFE-0070State Desync Between Related Variables medium · Logic / State SAFE-0081Storage vs Memory Misuse Causing State Bug medium · Logic / State SAFE-0093Selfdestruct Dependency / Forced Removal Assumption medium · Logic / State SAFE-0094Predictable Contract Address / CREATE2 Reorg Risk medium · Logic / State
← PreviousState Not Reset After Use (Action Replay)
Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0251 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs