# Protocol can be repeatedly gas griefed in AutoRange external call

Malicious onERC721Received callback burns all gas and reverts, griefing the AutoRange bot's execute() and draining protocol-paid gas fees.

- Payout: Contest reward
- Severity: medium
- Program: Revert Lend
- Credited: falconhoof
- Disclosed: 2024-05-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-03-revert-lend-findings/issues/459
- Library page: https://bugbountylibrary.com/r/c4%3A2024-03-revert-lend%3AM-02
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:dos

**Target:** AutoRange bot execute() / NPM safeTransferFrom ERC721 callback
**Root cause:** AutoRange::execute() transfers newly minted NFTs via NPM::safeTransferFrom(), invoking the recipient's onERC721Received; a malicious recipient can consume all gas and revert, and token config is only cleared at the end of execute(), so the griefing recurs.
**Steps:**
1. Deploy malicious contract implementing onERC721Received that loops while gasleft() > 5000 then reverts
2. Send an NPM NFT to the malicious contract
3. Call `AutoRange::configToken()` from the malicious contract to register token config
4. When bot detects range-change conditions it calls `execute()`, which calls safeTransferFrom -> malicious callback burns gas and reverts
5. Repeat across multiple tokenIds/configs to drain bot gas fees
**How found:** Code reading of AutoRange::execute() flow: noticed NFT delivery via safeTransferFrom invokes attacker-controlled onERC721Received, and that positionConfigs cleanup happens only after the transfer, enabling persistent griefing.
**Exploitation:** Attacker registers token configs pointing to a gas-burning reverting callback; each time the bot's execute() triggers, the callback exhausts gas and reverts, wasting the bot's transaction gas with no protocol fee generated.
**Escalation:** Register many tokenIds/configs to repeatedly grief the bot; config cannot be removed except at end of execute(), so griefing recurs.
**Insight:** When a protocol bot pays gas to push NFTs/tokens to users via safeTransferFrom or similar callbacks, the recipient controls execution mid-transaction; check whether state cleanup (config removal) occurs after the callback, allowing repeatable gas griefing.