Hats-Protocol / Hats-Protocol/hats-protocol
Potential for out-of-gas errors
- Dominant language
- Solidity
- Stars
- 98
- Forks
- 29
- PR merge metrics
- No merged PRs in 30d
Description
## Summary
The `batchCreateHats` function loops through arrays of potentially large sizes. If these arrays become too huge, the transaction may fail due to a lack of gas.
## Vulnerability Detail
https://github.com/Hats-Protocol/hats-protocol/blob/fafcfdf046c0369c1f9e077eacd94a328f9d7af0/src/Hats.sol#L183
The function `batchCreateHats` loops through several arrays of potentially large sizes to create hats. This means that for each `hat ` creation, a certain amount of gas is required. If the arrays are too large, there is a risk of running out of gas and the transaction failing. This could happen because the amount of gas specified by the user may not be enough to cover the gas costs of creating all the hats.
## Impact
The function will consume more gas than expected, resulting in an out-of-gas error and transaction failure.
## Code Snippet
```solidity
for (uint256 i = 0; i < length;) {
createHat(
_admins[i],
_details[i],
_maxSupplies[i],
_eligibilityModules[i],
_toggleModules[i],
_mutables[i],
_imageURIs[i]
);
unchecked {
++i;
}
}
success = true;
```
## Tool used
### Manual Review
## Recommendation
Properly estimate the gas costs of creating the hats and to ensure that the gas limit specified by the user is sufficient. We can also split the creation of the hats into smaller batches to reduce the amount of gas used for each batch.
Contributor guide
Research direction
Review src/Hats.sol around line 183 and the batchCreateHats entry point first. Determine whether the issue calls for bounded batching or another defined gas-handling behavior, then add tests that demonstrate the chosen outcome; done means the batch path has no unaddressed failure mode.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- solidity
- Domain
- blockchain, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100