# Single reverting entry halts shared loop

Loops or recovery paths that call external contracts per entry and revert on one bad entry

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2023-04-27. Updated 2026-10-25._

## How it works
A batch, queue, or recovery path iterates over entries and calls an external contract for each one. The code assumes every call succeeds. When one entry's external call reverts (a token that reverts on any call, an ERC721 `ownerOf` on a burned token, a per-caller cooldown), the whole loop reverts. Every later entry is blocked, and any state the loop was meant to update never updates. The assumption that breaks: that external components behave, and that one bad entry can be isolated. It cannot, because the revert propagates through the shared transaction.

## Where it shows up
- Loops calling `refPerTok`, `exchangeRateCurrent`, `ownerOf`, or similar per-entry external calls [E1](https://bugbountylibrary.com/r/c4%3A2023-01-reserve%3AM-16.md)[E2](https://bugbountylibrary.com/r/sherlock%3A2023-02-carapace%3AH-11.md)
- Governance recovery paths (unregister, disable, upgrade) that call into the very component they remove [E1](https://bugbountylibrary.com/r/c4%3A2023-01-reserve%3AM-16.md)
- Batch lock/settle/refresh functions where one entry's failure aborts all [E2](https://bugbountylibrary.com/r/sherlock%3A2023-02-carapace%3AH-11.md)
- Integrations where your contract aggregates many users under one address, inheriting a per-caller cooldown or rate limit as a shared lock [E3](https://bugbountylibrary.com/r/c4%3A2022-11-redactedcartel%3AH-01.md)
- Any `for` loop over external addresses with no per-entry try/catch or skip

## How to review
Trace every loop and recovery path and ask: if entry N reverts, do entries N+1..M still process? The invariant: no single external entry's failure may block processing of other entries or the removal path. Check that recovery functions do not depend on the component being removed. Check whether a per-caller restriction on an external protocol becomes shared when your contract is the single caller [E3](https://bugbountylibrary.com/r/c4%3A2022-11-redactedcartel%3AH-01.md). Confirm per-entry failures are caught and skipped, or that the loop is bounded and isolated.

## Variants seen
- Collateral token reverting bricks unregister, refresh, issue, redeem, staking [E1](https://bugbountylibrary.com/r/c4%3A2023-01-reserve%3AM-16.md)
- Burned NFT makes `ownerOf` revert inside a lock loop, so protections never lock [E2](https://bugbountylibrary.com/r/sherlock%3A2023-02-carapace%3AH-11.md)
- Shared per-caller cooldown turns any deposit into a global redeem block [E3](https://bugbountylibrary.com/r/c4%3A2022-11-redactedcartel%3AH-01.md)

## Impact and severity
High: permanent lock of all basket funds [E1](https://bugbountylibrary.com/r/c4%3A2023-01-reserve%3AM-16.md), loss of buyer compensation [E2](https://bugbountylibrary.com/r/sherlock%3A2023-02-carapace%3AH-11.md), cheap griefing DoS [E3](https://bugbountylibrary.com/r/c4%3A2022-11-redactedcartel%3AH-01.md). Worse when the blocked path is the only recovery route, or when triggering the revert is cheap for an attacker.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-01-reserve%3AM-16.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-02-carapace%3AH-11.md
- E3: https://bugbountylibrary.com/r/c4%3A2022-11-redactedcartel%3AH-01.md