In this track: Smart contract security foundations
advanced · 4 MIN READ
Denial of service in loops
Unbounded work can make a required operation impossible to complete.
LET’S PICTURE IT
A clerk required to process the entire growing queue in one sitting can eventually never finish.
SEE IT FOR YOURSELF
Calculate and split a manual execution feeStep 1 / 4
This example supplies twenty-one thousand gas used. It is a simple teaching input, not a live estimate of a contract call.
This example supplies twenty-one thousand gas used. It is a simple teaching input, not a live estimate of a contract call.With base ten Gwei, priority cap two and total cap twenty, the effective rate is twelve Gwei per gas.Twenty-one thousand times twelve Gwei gives two hundred fifty-two thousand Gwei, or 0.000252 ETH.The base-fee component is 0.00021 ETH and is burned. The priority component is 0.000042 ETH for the block fee recipient.
Animated local teaching model. No wallet, RPC or live blockchain data. Some labels and hashes are abbreviated for readability.
Locate required global loops
A function iterating over every participant can become too costly as the collection grows. The risk matters most when no alternate progress path exists.
Include failing recipients
One recipient that rejects a push payment can block a batch if the whole loop reverts. This is a separate issue from the number of iterations.
Design bounded progress
Pagination, pull-based claims or other bounded work can let the system advance without processing every user at once. Each design still needs consistent accounting.
Test worst-case growth
Measure maximum supported batch sizes and hostile recipient behavior. A test with three friendly participants does not establish long-term liveness.
Reason about the scenario
required task: pay every registered user in one call
risks: growing list + one rejecting recipient
review: bounded batches or independent claims
Pseudocode or a simplified scenario for local reasoning. This is not a production contract or a completed security review.
QUICK CHECK · NO PRESSURE
Can one reverting recipient block an all-or-nothing payout loop?