omermaksutii/rugproof/dos-vectors

DoS vector detection

When this applies

• Loops iterating over user-supplied or unbounded arrays
• Push-style payment patterns (contract pushes value to N recipients)
• Auctions that refund the previous highest bidder via direct transfer
• Mass claim() / distribute() functions
• Queues / stacks of withdrawals
• Functions whose gas cost scales with n users / n tokens
• L2 forced inclusion mechanics

Detection patterns

Unbounded loop over user-controlled array (CRITICAL-HIGH)

function distribute() external {
    for (uint i; i < holders.length; ++i) {
        payable(holders[i]).transfer(rewards[i]);   // ← gas grows; eventually un-callable
    }
}

Worse if attacker can grow holders (e.g. anyone can register).

Push-payment with revert-on-receive (HIGH)

function refundPreviousBidder() internal {
    payable(highBidder).transfer(highBid);   // ← attacker bids from contract that reverts on receive → freezes auction
}

Use pull-payments: store credits, let users withdraw.

.transfer (2300 gas) blocks smart-wallet receivers (MEDIUM-HIGH)

Smart wallets (Gnosis Safe, Argent) have fallback functions that need >2300 gas. Their users can't receive — effectively DoS for them.

Gas griefing via large calldata (HIGH on relayers)

Relayer pays gas; user provides bloated calldata to grief. Cap calldata length or charge per-byte.

external reentrant fee-loop DoS (HIGH)

Withdrawals from each strategy in a vault — if any strategy reverts, the entire withdraw fails. Use try/catch per strategy.

Block-stuffing exposure (MEDIUM)

Auction ending exactly at block.number == N lets an attacker fill the block to prevent your bid. Use deadline windows + sniping protection (extend on late bid).

Underflow-revert DoS on legacy 0.7.x code (MEDIUM)

Unchecked subtraction in Solidity ≥0.8 reverts on underflow — function permanently broken if state lands in that range.

selfdestruct to force ether on a contract that asserts address(this).balance == X (HIGH)

Anyone can selfdestruct to your contract and break a balance-equality check. Don't rely on address(this).balance equality. (Note EIP-6780 changed selfdestruct semantics — see [[selfdestruct-eip6780]].)

Forced inclusion on Arbitrum / Optimism (LOW-MEDIUM)

On rollups, anyone can force-include a tx via L1 — affects "exclusive sequencer" assumptions in auctions.

Severity rubric

Remediation patterns

• Pull over push — credit balances, users withdraw.
• Per-iteration isolation — try/catch around per-element work in batch ops.
• Batch caps — require(arr.length <= MAX).
• Pagination — distribute(start, end).
• Use `call` not `transfer` — forward all gas, then check return.
• Don't rely on `address(this).balance` equality — track expected balance separately.
• Auction extensions — extend deadline on late bid to defeat block-stuffing.

False-positive notes

• Loops over a contract-controlled small bounded array (e.g. fixed 3 strategies) are fine — note the bound.
• Internal admin functions where DoS only hurts the admin → Info.

Related

• [[unchecked-calls]]
• [[selfdestruct-eip6780]]
• [[reentrancy]]