Hats-Protocol / Hats-Protocol/hats-protocol

Potential for out-of-gas errors

Open
#101 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Solidity
Stars
98
Forks
29
PR merge metrics
No merged PRs in 30d

Description

## Summary
The `batchCreateHats` function loops through arrays of potentially large sizes. If these arrays become too huge, the transaction may fail due to a lack of gas.

## Vulnerability Detail
https://github.com/Hats-Protocol/hats-protocol/blob/fafcfdf046c0369c1f9e077eacd94a328f9d7af0/src/Hats.sol#L183

The function `batchCreateHats` loops through several arrays of potentially large sizes to create hats. This means that for each `hat ` creation, a certain amount of gas is required. If the arrays are too large, there is a risk of running out of gas and the transaction failing. This could happen because the amount of gas specified by the user may not be enough to cover the gas costs of creating all the hats.

## Impact
The function will consume more gas than expected, resulting in an out-of-gas error and transaction failure.
## Code Snippet
```solidity
for (uint256 i = 0; i < length;) {
createHat(
_admins[i],
_details[i],
_maxSupplies[i],
_eligibilityModules[i],
_toggleModules[i],
_mutables[i],
_imageURIs[i]
);

unchecked {
++i;
}
}

success = true;
```
## Tool used

### Manual Review

## Recommendation

Properly estimate the gas costs of creating the hats and to ensure that the gas limit specified by the user is sufficient. We can also split the creation of the hats into smaller batches to reduce the amount of gas used for each batch.

Contributor guide

Open the contributing guide

Research direction

Review src/Hats.sol around line 183 and the batchCreateHats entry point first. Determine whether the issue calls for bounded batching or another defined gas-handling behavior, then add tests that demonstrate the chosen outcome; done means the batch path has no unaddressed failure mode.

Written by the indexing model from the issue text.

Assessment

Tech stack
solidity
Domain
blockchain, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.