In this track: Execution traces and low-level calls
advanced · 4 MIN READ
Return-data griefing explained
Large attacker-controlled output can make caller-side processing expensive.
LET’S PICTURE IT
A small request can trigger an enormous attachment that overloads the receiving desk.
SEE IT FOR YOURSELF
Use temporary memory in one execution frameStep 1 / 4
This frame uses temporary byte-addressed memory. Solidity normally keeps a free memory pointer at address 0x40, initially pointing to 0x80.
This frame uses temporary byte-addressed memory. Solidity normally keeps a free memory pointer at address 0x40, initially pointing to 0x80.In this simplified example, MSTORE writes integer forty-two into thirty-two bytes beginning at memory byte 0x80. Accessing this range may expand active memory.MLOAD at byte 0x80 reads that complete thirty-two-byte word back as a stack value. It does not fetch persistent storage or network data.RETURN can expose a chosen memory range as output. Frame memory is temporary; returning data does not turn it into persistent contract state.
Animated local teaching model. No wallet, RPC or live blockchain data. Some labels and hashes are abbreviated for readability.
Identify who controls the bytes
An external target may return or revert with a large payload. The caller cannot assume a familiar short ABI result merely because it requested a simple function.
Account for memory and copying
Copying the complete buffer into memory can expand memory and consume gas. Automatic convenience wrappers may perform work that a low-level review should inspect.
Limit unnecessary processing
Read only the output required by the protocol when possible and validate its shape. Choose bounded failure reporting instead of blindly forwarding unlimited diagnostic content.
Test hostile outputs
Include large success and failure payloads in local tests. Verify that failure handling itself does not violate accounting or leave essential cleanup unfinished.
Follow the execution
Caller requests a short result
Target supplies a very large byte buffer
Caller copies all bytes → memory expansion and copy cost
Bound work according to the actual interface need.
A local conceptual trace with explicit assumptions; this is not a trace of a live transaction.
QUICK CHECK · NO PRESSURE
Can failure-message copying consume significant caller gas?
Large revert bytes can cause memory and copy work.