Skip to content
Request an audit

‹ Findings database

BatchOut:withdrawFulfill() can be DoSed by spamming withdrawal requests, leading to OOG reverts

Crit/HighClip Finance Strategies audit·Three Sigma·DeFi infrastructure·10th November, 20233S-Clip Finance-H04

Description

Anyone can schedule as many withdrawals as they want in BatchOut:scheduleWithdraw(), specifying little shares to different withdrawTo addresses. Then, in withdrawFulfill(), it will loop over all the requests in the cycle, leading to OOG reverts if enough requests were spammed.

Recommendation

Send as argument a number of requests to fulfill, so the OOG revert can be prevented.

Status

Addressed in #4dc4687

Source

Disclosed by 0xSimao · Sherlock's 2025 Watson of the Year · 21 first places in 57 audit contests