# calculateTVL may run out of gas for modest number of operators and tokens breaking deposits, withdrawals, and trades

RestakeManager.calculateTVLs uses nested operator×token loops with external oracle/strategy calls, so gas grows quadratically and can exceed block gas limit, bricking deposits, withdrawals and Balancer trades.

- Payout: Contest reward
- Severity: medium
- Program: Renzo
- Credited: guhu95
- Disclosed: 2024-06-07
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-04-renzo-findings/issues/514
- Library page: https://bugbountylibrary.com/r/c4%3A2024-04-renzo%3AM-05
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:dos

**Target:** RestakeManager.calculateTVLs on-chain TVL calculation
**Root cause:** Nested loops over operator delegators and tokens each perform external calls to Eigenlayer strategies and oracles plus memory allocation, making gas cost quadratic in OD×token count.
**Steps:**
1. Observe calculateTVLs loops over each OD and each token, calling getTokenBalanceFromStrategy and renzoOracle per pair.
2. Profile a live tx: 1 OD × 2 tokens ≈ 450K gas.
3. Extrapolate to 12 ODs × 12 tokens = 144 iterations → ~32M gas (450K*144/2), exceeding block gas limit.
4. Note calculateTVLs is invoked in deposit, withdrawal, and BalancerRateProvider trade paths, so exceeding ~1-2M gas makes them unusable.
**How found:** Code reading of RestakeManager identified nested loops with external calls and memory allocation; gas profiling of a real transaction quantified per-iteration cost, then extrapolated to Eigenlayer's supported token count.
**Escalation:** As operators/tokens scale, gas crosses block limit and all flows calling calculateTVLs revert, causing protocol-wide DoS.
**Insight:** When a view used by every user flow loops over two growing dimensions with external calls, profile one real tx and extrapolate to the protocol's advertised max dimensions to find a scaling DoS before it manifests.