dos-griefing-analysis

Name: dos-griefing-analysis
Author: quillai-network

114stars23forks

How to install dos-griefing-analysis?

quillai-network/quillshield_skills/dos-griefing-analysis

$npx -y skills add quillai-network/quillshield_skills --skill dos-griefing-analysis

Installs into the current project.

Summary

Detects Denial of Service and griefing vulnerabilities in smart contracts. Covers unbounded loop DoS, block gas limit exhaustion, external call failure DoS, insufficient gas griefing (63/64 rule), storage bloat attacks, timestamp griefing, self-destruct force-feeding, and push vs

Files · 1

View on GitHub

SKILL.md

1	# DoS & Griefing Analysis
2
3	Detect vulnerabilities that allow attackers to make contracts unusable (Denial of Service) or harm other users at low cost (griefing). These attacks don't steal funds directly but can permanently brick contracts or block critical operations.
4
5	## When to Use
6
7	- Auditing contracts with loops over dynamic arrays or mappings
8	- Reviewing batch operations (airdrops, reward distribution, liquidation)
9	- Analyzing contracts that rely on `address(this).balance` for logic
10	- Verifying that individual user failures don't block system-wide operations
11	- Checking for gas-based attack vectors (insufficient gas, storage bloat)
12
13	## When NOT to Use
14
15	- Direct fund theft analysis (use behavioral-state-analysis)
16	- Access control consistency (use semantic-guard-analysis)
17	- Reentrancy detection (use reentrancy-pattern-analysis)
18
19	## Seven DoS & Griefing Vulnerability Classes
20
21	### Class 1: Unbounded Loop DoS
22
23	Loops that iterate over collections that grow with contract usage. As the collection grows, gas cost increases until the function exceeds the block gas limit and becomes permanently uncallable.
24
25	```solidity
26	// VULNERABLE: Loop over all users — grows forever
27	address[] public allUsers;
28
29	function distributeRewards() external {
30	for (uint i = 0; i < allUsers.length; i++) {
31	// If allUsers has 10,000+ entries, this exceeds block gas limit
32	token.transfer(allUsers[i], calculateReward(allUsers[i]));
33	}
34	}
35
36	// SAFE: Paginated processing
37	function distributeRewards(uint256 startIndex, uint256 batchSize) external {
38	uint256 end = min(startIndex + batchSize, allUsers.length);
39	for (uint i = startIndex; i < end; i++) {
40	token.transfer(allUsers[i], calculateReward(allUsers[i]));
41	}
42	}
43
44	// SAFER: Pull pattern
45	mapping(address => uint256) public pendingRewards;
46
47	function claimReward() external {
48	uint256 reward = pendingRewards[msg.sender];
49	pendingRewards[msg.sender] = 0;
50	token.transfer(msg.sender, reward);
51	}
52	```
53
54	Detection:
55
56	```
57	For each loop in the contract:
58	1. What determines the loop bound?
59	- Fixed constant → SAFE
60	- Constructor parameter → SAFE (if reasonable)
61	- Dynamic array length → POTENTIALLY VULNERABLE
62	- Mapping iteration → VULNERABLE (can't iterate mappings, but workaround arrays are vulnerable)
63	2. Can the loop bound grow with contract usage?
64	3. What is the gas cost per iteration?
65	4. At what size does total gas exceed 30M? (block gas limit)
66
67	If loop_bound is unbounded AND gas_per_iteration > 30M / estimated_max_users:
68	→ UNBOUNDED LOOP DOS
69	```
70
71	### Class 2: External Call Failure DoS
72
73	A single failed external call in a batch operation blocks all other operations.
74
75	```solidity
76	// VULNERABLE: One blacklisted user blocks ALL distributions
77	function distributeToAll(address[] calldata users, uint256[] calldata amounts) external {
78	for (uint i = 0; i < users.length; i++) {
79	// If users[5] is USDC-blacklisted, this reverts for ALL users
80	require(token.transfer(users[i], amounts[i]), "Transfer failed");
81	}
82	}
83
84	// SAFE: Handle failures individually
85	function distributeToAll(address[] calldata users, uint256[] calldata amounts) external {
86	for (uint i = 0; i < users.length; i++) {
87	try IERC20(token).transfer(users[i], amounts[i]) returns (bool success) {
88	if (!success) emit TransferFailed(users[i], amounts[i]);
89	} catch {
90	emit TransferFailed(users[i], amounts[i]);
91	}
92	}
93	}
94	```
95
96	Detection:
97
98	```
99	For each loop containing external calls:
100	1. Does a failed call revert the entire transaction? (require/revert)
101	2. Is there try/catch or success-check-and-skip?
102	3. Can any single address/user cause the call to fail?
103	- Blacklisted address
104	- Contract that reverts in receive()
105	- Address that runs out of gas
106	If yes → EXTERNAL CALL FAILURE DOS
107	```
108
109	### Class 3: Insufficient Gas Griefing (63/64 Rule)
110
111	EIP-150's 63/64 rule: when making an external call, only 63/64 of remaining gas is forwarded. An attacker can supply just enough gas for the outer function to succeed while the inner call fails.
112
113	```solidity
114	// VULNERABLE: Relayer pattern without gas check
115	function executeMetaTx(address target, bytes calldata data) external {
116	// Attacker (relayer) provides just enough gas for this function
117	// but NOT enough for target.call(data) to succeed
118	(bool success, ) = target.call(data);
119	// success = false (

People who liked this also viewed

6 picks

Type

dos-griefing-analysis

114stars23forks

View on GitHub

How to install dos-griefing-analysis?

quillai-network/quillshield_skills/dos-griefing-analysis

$npx -y skills add quillai-network/quillshield_skills --skill dos-griefing-analysis

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# DoS & Griefing Analysis
2
3	Detect vulnerabilities that allow attackers to make contracts unusable (Denial of Service) or harm other users at low cost (griefing). These attacks don't steal funds directly but can permanently brick contracts or block critical operations.
4
5	## When to Use
6
7	- Auditing contracts with loops over dynamic arrays or mappings
8	- Reviewing batch operations (airdrops, reward distribution, liquidation)
9	- Analyzing contracts that rely on `address(this).balance` for logic
10	- Verifying that individual user failures don't block system-wide operations
11	- Checking for gas-based attack vectors (insufficient gas, storage bloat)
12
13	## When NOT to Use
14
15	- Direct fund theft analysis (use behavioral-state-analysis)
16	- Access control consistency (use semantic-guard-analysis)
17	- Reentrancy detection (use reentrancy-pattern-analysis)
18
19	## Seven DoS & Griefing Vulnerability Classes
20
21	### Class 1: Unbounded Loop DoS
22
23	Loops that iterate over collections that grow with contract usage. As the collection grows, gas cost increases until the function exceeds the block gas limit and becomes permanently uncallable.
24
25	```solidity
26	// VULNERABLE: Loop over all users — grows forever
27	address[] public allUsers;
28
29	function distributeRewards() external {
30	for (uint i = 0; i < allUsers.length; i++) {
31	// If allUsers has 10,000+ entries, this exceeds block gas limit
32	token.transfer(allUsers[i], calculateReward(allUsers[i]));
33	}
34	}
35
36	// SAFE: Paginated processing
37	function distributeRewards(uint256 startIndex, uint256 batchSize) external {
38	uint256 end = min(startIndex + batchSize, allUsers.length);
39	for (uint i = startIndex; i < end; i++) {
40	token.transfer(allUsers[i], calculateReward(allUsers[i]));
41	}
42	}
43
44	// SAFER: Pull pattern
45	mapping(address => uint256) public pendingRewards;
46
47	function claimReward() external {
48	uint256 reward = pendingRewards[msg.sender];
49	pendingRewards[msg.sender] = 0;
50	token.transfer(msg.sender, reward);
51	}
52	```
53
54	Detection:
55
56	```
57	For each loop in the contract:
58	1. What determines the loop bound?
59	- Fixed constant → SAFE
60	- Constructor parameter → SAFE (if reasonable)
61	- Dynamic array length → POTENTIALLY VULNERABLE
62	- Mapping iteration → VULNERABLE (can't iterate mappings, but workaround arrays are vulnerable)
63	2. Can the loop bound grow with contract usage?
64	3. What is the gas cost per iteration?
65	4. At what size does total gas exceed 30M? (block gas limit)
66
67	If loop_bound is unbounded AND gas_per_iteration > 30M / estimated_max_users:
68	→ UNBOUNDED LOOP DOS
69	```
70
71	### Class 2: External Call Failure DoS
72
73	A single failed external call in a batch operation blocks all other operations.
74
75	```solidity
76	// VULNERABLE: One blacklisted user blocks ALL distributions
77	function distributeToAll(address[] calldata users, uint256[] calldata amounts) external {
78	for (uint i = 0; i < users.length; i++) {
79	// If users[5] is USDC-blacklisted, this reverts for ALL users
80	require(token.transfer(users[i], amounts[i]), "Transfer failed");
81	}
82	}
83
84	// SAFE: Handle failures individually
85	function distributeToAll(address[] calldata users, uint256[] calldata amounts) external {
86	for (uint i = 0; i < users.length; i++) {
87	try IERC20(token).transfer(users[i], amounts[i]) returns (bool success) {
88	if (!success) emit TransferFailed(users[i], amounts[i]);
89	} catch {
90	emit TransferFailed(users[i], amounts[i]);
91	}
92	}
93	}
94	```
95
96	Detection:
97
98	```
99	For each loop containing external calls:
100	1. Does a failed call revert the entire transaction? (require/revert)
101	2. Is there try/catch or success-check-and-skip?
102	3. Can any single address/user cause the call to fail?
103	- Blacklisted address
104	- Contract that reverts in receive()
105	- Address that runs out of gas
106	If yes → EXTERNAL CALL FAILURE DOS
107	```
108
109	### Class 3: Insufficient Gas Griefing (63/64 Rule)
110
111	EIP-150's 63/64 rule: when making an external call, only 63/64 of remaining gas is forwarded. An attacker can supply just enough gas for the outer function to succeed while the inner call fails.
112
113	```solidity
114	// VULNERABLE: Relayer pattern without gas check
115	function executeMetaTx(address target, bytes calldata data) external {
116	// Attacker (relayer) provides just enough gas for this function
117	// but NOT enough for target.call(data) to succeed
118	(bool success, ) = target.call(data);
119	// success = false (

People who liked this also viewed

6 picks

Type