# Hats.uri function can be DOSed by providing large details or imageURI string or cause large gas fees

Unbounded details/imageURI strings in Hats hats make uri()/viewHat() exceed block gas limit, DoSing reads or forcing callers to burn up to 30M gas.

- Payout: Contest reward
- Severity: medium
- Program: Hats
- Credited: roguereddwarf
- Disclosed: 2023-02-15
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-hats-judging/issues/2
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-hats%3AM-17
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:dos

**Target:** Hats.sol uri()/viewHat() and changeHatDetails/changeHatImageURI
**Root cause:** details and imageURI strings have no length cap, so uri() builds an arbitrarily large JSON string whose gas cost can exceed the block gas limit.
**Steps:**
1. On a low-cost chain (e.g. Polygon, 30M block gas limit), repeatedly call `changeHatDetails` to grow the details string incrementally, since one tx cannot set a string large enough.
2. Each ~1M gas of extra uri() cost costs at most ~15M gas to write; ~30 iterations (~450M gas, ~$92) suffice.
3. Call `Hats.uri(hatId)`; string concatenation exceeds 30M gas and reverts.
4. Optionally make the hat immutable so the string can no longer be changed.
**How found:** Code reading of uri()'s JSON string construction and reasoning about gas cost of unbounded string concatenation versus block gas limit, plus gas-cost estimation for incremental writes.
**Exploitation:** Attacker gradually inflates details/imageURI via changeHatDetails/changeHatImageURI, then any caller of uri() or viewHat() reverts or pays up to 30M gas (~$6 on Polygon), and the hat can be made immutable to lock it in.
**Escalation:** Also DoSes viewHat(), the only way other contracts read hat status/properties.
**Insight:** When a view function concatenates user-controlled strings, compute worst-case gas against the chain's block gas limit and check whether incremental setters let an attacker cheaply accumulate state that makes reads unaffordable.