In this track: Smart contract security foundations
advanced · 4 MIN READ
Unbounded storage growth
Persistent collections need a plan for future access costs.
LET’S PICTURE IT
A cabinet that grows forever can make later catalog operations impractical.
SEE IT FOR YOURSELF
Pack small values into Solidity storage slotsStep 1 / 4
In this simple default-layout example, two uint128 values come before one uint256. Each slot holds thirty-two bytes.
In this simple default-layout example, two uint128 values come before one uint256. Each slot holds thirty-two bytes.The first sixteen-byte value occupies the low-order half of slot zero. Low-order bytes are shown on the right.The second uint128 fits in the remaining sixteen bytes. Both values now share slot zero.C needs a complete thirty-two-byte slot, so it begins at slot one. Two packed small values plus C use two slots.
Animated local teaching model. No wallet, RPC or live blockchain data. Some labels and hashes are abbreviated for readability.
Identify who can add entries
A public operation may create persistent records repeatedly. Even cheap individual additions can expand the data a later required function must process.
Separate storage size and loop work
A large mapping is not automatically iterated by the EVM. The application’s indexing and traversal code determine which operations become expensive.
Bound critical operations
Avoid requiring a complete scan of all historical entries to withdraw, settle or upgrade. Define pagination and cleanup behavior where the application needs them.
Test a long-lived state
Construct local states representing many past actions and check essential progress. Fresh deployments are not enough to reveal growth-dependent failure.
Reason about the scenario
many small additions
→ large historical index
→ required full scan may exceed practical gas
Review the later operation, not only insertion.
Pseudocode or a simplified scenario for local reasoning. This is not a production contract or a completed security review.
QUICK CHECK · NO PRESSURE
Does the EVM automatically iterate through every mapping entry on a lookup?
The application determines any explicit traversal.