Unbounded external loops can permanently DoS administration — gas-limit denial of service

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 18211-external-calls-in-loop-can-lead-to-denial-of-service-trailof. Standalone Foundry PoC and full write-up: 18211-external-calls-in-loop-can-lead-to-denial-of-service-trailof_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/dos/unbounded-loop · vuln/dependency/unsafe-external-call

Reproduction: self-contained synthetic Foundry reduction; see output.txt.

Key info#

TL;DR#

An ever-growing assetsMapped array is traversed with external approvals. One paused/reverting token traps the whole operation; in production, array growth alone can exceed the gas limit.

Background#

The Origin Dollar review identifies this pattern in AaveStrategy and several other contracts. The reduction models the first failing asset and captures the resulting denial of service.

The vulnerable code#

for (uint256 i; i < assetsMapped.length; ++i) {
    IApprover(assetsMapped[i]).approve(address(this), type(uint256).max);
}

Root cause#

There is no bounded iteration, removal path, or per-item failure handling for an externally controlled, unbounded list.

Preconditions#

• The mapped asset list can grow over time.
• At least one asset can revert or the loop can exceed the block gas limit.

Attack walkthrough#

1. Exploit adds a healthy and a paused FailingAsset.
2. safeApproveAllTokens reaches the paused token and reverts.
3. The Proof event at output.txt:385 records the failed administrative call.

Diagrams#

Remediation#

Process bounded slices, permit removal/compaction, and isolate per-asset failures. Avoid requiring one transaction to call every external token.

How to reproduce#

cd evm-hack-registry/18211-external-calls-in-loop-can-lead-to-denial-of-service-trailof_exp
forge test -vvvvv

Sources#

• AuditVault finding
• Trail of Bits Origin Dollar review
• Synthetic test

Reference: https://github.com/trailofbits/publications/blob/master/reviews/OriginDollar.pdf

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 18211-external-calls-in-loop-can-lead-to-denial-of-service-trailof_exp (evm-hack-registry mirror).
• AuditVault finding: 18211-external-calls-in-loop-can-lead-to-denial-of-service-trailof.

Alerts & third-party analyses

• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.