# Impossible to call withdrawReward fails due to run out of gas

IncentiveDistribution.withdrawReward loops from uninitialized lastUpdatedDay (0) to current day, ~18724 iterations, exhausting gas so rewards can never be withdrawn.

- Payout: Audit contest
- Severity: high
- Program: Marginswap
- Disclosed: 2021-05-03
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-04-marginswap-findings/issues/65
- Library page: https://bugbountylibrary.com/r/c4%3A2021-04-marginswap%3AH-11
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity vuln:dos

**Target:** IncentiveDistribution.sol withdrawReward loop
**Root cause:** lastUpdatedDay is never initialized so it defaults to 0; withdrawReward iterates day-by-day from 0 to the current day (~18724 iterations), exceeding block gas limit. A second unbounded loop over allTranches compounds the risk.
**Steps:**
1. Call `withdrawReward` on IncentiveDistribution.sol (line 224).
2. Loop at line 269 iterates dayDiff = currentDay - lastUpdatedDay; lastUpdatedDay == 0 so dayDiff ≈ 18724.
3. With gasLimit 9500000 execution stops at iteration ~270, reverting out-of-gas.
4. Loop over unbounded `allTranches` array (line 281) can also exhaust gas as owner adds tranches.
**How found:** Code review of withdrawReward loop bounds; noticed lastUpdatedDay uninitialized (defaults to 0) and computed dayDiff from deployment date, then tested gas consumption per iteration.
**Insight:** Check state variables that gate loop bounds for missing initialization — an uninitialized timestamp makes a per-day loop start at epoch 0, turning a bounded loop into a gas bomb; also flag unbounded owner-growable arrays iterated in user-facing functions.