Dos Attack

Denial of Service (DoS) Attack Patterns

OWASP SC10:2025 - DoS attacks prevent legitimate users from accessing protocol functionality, potentially locking funds permanently.

2025-2026 Statistics: DoS vulnerabilities caused protocol freezes affecting $180M+ in locked funds, with gas griefing attacks increasing 45% YoY.

Why DoS Happens (Root Causes)

Root Cause 1: Unbounded Iteration

Loops without gas limits become unusable as data grows.

// VULNERABLE: Unbounded loop
function distributeRewards() external {
    for (uint256 i = 0; i < holders.length; i++) {  // @audit holders can grow unbounded
        token.transfer(holders[i], rewards[holders[i]]);
    }
}

Attacker's view: "I'll create thousands of tiny positions. Eventually, no one can call this function."

Root Cause 2: External Call Dependency

Function success depends on external call that attacker can make fail.

// VULNERABLE: Relies on external transfer success
function withdrawAll() external {
    for (uint256 i = 0; i < users.length; i++) {
        payable(users[i]).transfer(balances[users[i]]);  // @audit One revert blocks all
    }
}

Attacker's view: "If I'm in the array and my receive() reverts, nobody gets paid."

Root Cause 3: Storage Slot Exhaustion

Unlimited storage growth makes operations cost-prohibitive.

// VULNERABLE: Unlimited storage growth
mapping(address => uint256[]) public userDeposits;

function deposit() external payable {
    userDeposits[msg.sender].push(msg.value);  // @audit Array grows forever
}

function getTotalDeposits(address user) external view returns (uint256) {
    uint256 total;
    for (uint256 i = 0; i < userDeposits[user].length; i++) {  // @audit View can run out of gas
        total += userDeposits[user][i];
    }
    return total;
}

Root Cause 4: Block Gas Limit Exploitation

Transaction exceeds block gas limit, making it impossible to execute.

// VULNERABLE: Can exceed block gas limit
function processAllPending() external {
    while (pendingQueue.length > 0) {
        _processSingle(pendingQueue[0]);
        pendingQueue.pop();
    }
}

The Liveness Analysis Map (Core Artifact)

For each critical function, document:

Function: withdrawAll()
├── External Calls: N calls to user addresses
├── Loop Bound: users.length (unbounded)
├── Gas Estimate: O(n) where n = users count
├── Failure Mode: Single revert blocks all withdrawals
├── Recovery: None - funds permanently locked
└── Risk: CRITICAL

Detection Patterns

Pattern 1: Unbounded Loop DoS

Root Cause: Unbounded Iteration

// VULNERABLE: Loop over dynamic array
function processAll() external {
    for (uint256 i = 0; i < items.length; i++) {
        _process(items[i]);
    }
}

Attack Flow:

1. Attacker adds many small items to array
2. Array grows to thousands of entries
3. Gas cost exceeds block limit
4. Function becomes uncallable
5. Funds/operations permanently stuck

Search Queries:

Grep("for.*\\.length|while.*\\.length", glob="**/*.sol")
Grep("for.*i\\+\\+|for.*i < ", glob="**/*.sol")

Mitigation:

// SECURE: Pagination pattern
function processRange(uint256 start, uint256 end) external {
    require(end <= items.length && end - start <= MAX_BATCH);
    for (uint256 i = start; i < end; i++) {
        _process(items[i]);
    }
}

Pattern 2: External Call Failure DoS

Root Cause: External Call Dependency

// VULNERABLE: One failure blocks all
function refundAll() external {
    for (uint256 i = 0; i < refundees.length; i++) {
        (bool success,) = refundees[i].call{value: amounts[i]}("");
        require(success, "Refund failed");  // @audit Blocks on any failure
    }
}

Attack Flow:

1. Attacker enters system with contract that reverts on receive
2. Refund function iterates to attacker's address
3. Attacker's receive() reverts
4. Entire function reverts
5. All refunds blocked

Search Queries:

Grep("\\.call\\{value.*require\\(success", glob="**/*.sol")
Grep("\\.transfer\\(|send\\(", glob="**/*.sol")

Mitigation:

// SECURE: Pull pattern
mapping(address => uint256) public pendingRefunds;

function withdraw() external {
    uint256 amount = pendingRefunds[msg.sender];
    pendingRefunds[msg.sender] = 0;
    (bool success,) = msg.sender.call{value: amount}("");
    require(success);
}

Pattern 3: Gas Griefing

Root Cause: Unchecked Gas Forwarding

// VULNERABLE: Forwards all gas to untrusted call
function executeCallback(address target, bytes calldata data) external {
    (bool success,) = target.call(data);  // @audit Attacker can consume all gas
    require(success);
}

Attack Flow:

1. Attacker creates contract with expensive fallback
2. Callback executes, consuming all forwarded gas
3. Parent transaction fails or behaves unexpectedly
4. Griefing attack succeeds

Search Queries:

Grep("\\.call\\(|\\.delegatecall\\(", glob="**/*.sol")
Grep("gasleft\\(\\)", glob="**/*.sol")

Mitigation:

// SECURE: Limit gas forwarded
(bool success,) = target.call{gas: 50000}(data);
// OR use try/catch
try ICallback(target).callback{gas: 50000}(data) {} catch {}

Pattern 4: Block Stuffing

Risk: Attacker fills blocks to prevent time-sensitive operations

// VULNERABLE: Time-sensitive operation
function claimAuction() external {
    require(block.timestamp >= auctionEnd, "Auction ongoing");
    require(!claimed, "Already claimed");
    claimed = true;
    // Transfer winning bid...
}

Attack Flow:

1. Attacker sees they're losing auction
2. Before auction ends, attacker submits many high-gas transactions
3. Blocks become full, legitimate claimAuction() can't execute
4. Attacker extends effective auction time
5. Eventually claims at manipulated state

Mitigation:

• Add grace periods for time-sensitive operations
• Use commit-reveal for auctions
• Allow partial execution

Pattern 5: Storage Collision DoS

Root Cause: Unlimited Mapping/Array Growth

// VULNERABLE: Unlimited storage per user
function addOrder(uint256 amount) external {
    userOrders[msg.sender].push(Order(amount, block.timestamp));
}

function cancelAllOrders() external {
    delete userOrders[msg.sender];  // @audit Gas increases with array size
}

Attack Flow:

1. Attacker creates millions of tiny orders
2. Tries to cancel all (or system tries to process)
3. Gas exceeds limits
4. Operations blocked

Search Queries:

Grep("push\\(|delete.*\\[", glob="**/*.sol")
Grep("mapping.*\\[\\]|address.*=>.*\\[\\]", glob="**/*.sol")

Pattern 6: Return Bomb Attack

Root Cause: Unbounded Return Data

// VULNERABLE: Copies all return data
function executeCall(address target, bytes calldata data) external returns (bytes memory) {
    (bool success, bytes memory result) = target.call(data);  // @audit result can be huge
    require(success);
    return result;
}

Attack Flow:

1. Attacker creates contract returning massive data (e.g., 1MB)
2. Memory expansion costs explode
3. Transaction runs out of gas
4. Call fails unexpectedly

Mitigation:

// SECURE: Limit return data or use assembly
assembly {
    let success := call(gas(), target, 0, add(data, 32), mload(data), 0, 0)
    // Only copy limited return data if needed
}

DoS Prevention Checklist

Loop Safety

• All loops have bounded iterations
• Maximum batch size enforced
• Pagination available for large datasets
• Gas estimation includes worst case

External Call Safety

• Pull pattern over push pattern
• Individual call failures don't block others
• Gas limits on external calls
• Fallback handling for failed transfers

Storage Safety

• No unbounded arrays per user
• Cleanup mechanisms exist
• View functions handle large data

Time Safety

• Grace periods for time-sensitive ops
• No strict time windows attackers can exploit
• Block stuffing resistance

Search Query Reference

# Find unbounded loops
Grep("for.*\\.length|while.*length", glob="**/*.sol")
Grep("for.*i\\+\\+.*\\{", glob="**/*.sol")

# Find external calls
Grep("\\.call\\{|\\.transfer\\(|\\.send\\(", glob="**/*.sol")
Grep("require\\(success", glob="**/*.sol")

# Find storage patterns
Grep("push\\(|pop\\(|delete", glob="**/*.sol")
Grep("mapping.*\\[\\]", glob="**/*.sol")

# Find time dependencies
Grep("block\\.timestamp|block\\.number", glob="**/*.sol")

Severity Classification

Critical

• Funds permanently locked
• Core protocol functions uncallable
• No recovery mechanism

High

• Temporary protocol freeze possible
• Significant gas griefing impact
• User funds at risk

Medium

• View functions can fail
• Minor operations blockable
• Recovery exists but costly

Rationalization Table (Reject These Excuses)