# Withdrawals with high gas limits can be bricked by a malicious user, permanently locking funds

OptimismPortal's gas check ignored EIP-150's 63/64 rule, letting a griefer finalize a high-gas withdrawal with just enough gas to pass the check but under-forward gas, bricking the withdrawal and locking funds.

- Payout: Contest reward
- Severity: high
- Program: Optimism
- Credited: Allarious
- Disclosed: 2023-01-19
- Write-up quality: 8/10
- Original: https://github.com/sherlock-audit/2023-01-optimism-judging/issues/96
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-optimism%3AH-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** OptimismPortal.finalizeWithdrawalTransaction (L1 bridge contract)
**Root cause:** The require check `gasleft() >= _tx.gasLimit + FINALIZE_GAS_BUFFER` does not account for EIP-150's 63/64 rule, so for gasLimit > ~952,192 the EVM forwards less than the requested gas even though the check passes.
**Steps:**
1. Identify withdrawal with gasLimit X > 952,192 (e.g. 11,245,655).
2. Compute gas needed at call: X*64/63; check passes if gasleft() >= X + 20,000 (~X+14,878 at call).
3. Call `finalizeWithdrawalTransaction(_tx)` with gas in the sweet spot between X+20,000 and X*64/63+overhead (e.g. 11,266,735).
4. Require passes, but SafeCall requests gasleft()-20000+5122 > 63/64 of available, so EVM silently forwards less than X.
5. Target call runs out of gas and reverts; no replay exists, so withdrawal is permanently bricked and ETH stays in OptimismPortal.
**How found:** Reading the Portal's gas-sufficiency comment and check, then reasoning about EIP-150's 63/64 cap on forwarded gas; noticed the hardcoded FINALIZE_GAS_BUFFER (14,878 at call) is smaller than X/64 for large X, creating a window where the check passes but insufficient gas is forwarded.
**Exploitation:** Attacker monitors L1 for pending finalizeWithdrawalTransaction calls with high gasLimit, front-runs with a precisely-sized gas amount that passes the require but under-forwards gas, causing the withdrawal to revert irrecoverably and locking the user's ETH in the Portal.
**Insight:** When a contract asserts it forwards at least `gasLimit` to an external call, verify the check accounts for EIP-150's 63/64 rule: the buffer must exceed gasLimit/64, otherwise any gasLimit above ~64*buffer is griefable.