# Unbound recursive function call can use unlimited gas and break hats operation

Unbounded recursion in Hats isAdminOfHat and related tree-traversal functions lets deeply nested linked trees exhaust gas, bricking admin checks and hat operations.

- Payout: Contest reward
- Severity: medium
- Program: Hats
- Credited: 0xMojito
- Disclosed: 2023-02-15
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-hats-judging/issues/96
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-hats%3AM-4
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:dos

**Target:** Hats.sol / HatsIdUtilities.sol tree traversal functions
**Root cause:** isAdminOfHat, getImageURIForHat, getTippyTopHatDomain and noCircularLinkage recurse/traverse linkedTreeAdmins without a depth cap, so gas cost scales with tree depth and can exceed block limits.
**Steps:**
1. Build two separate hat trees each with ~1000 nested root hats (TIPHat1, TIPHat2).
2. Link TIPHat1 to Hat2 in the other tree via the top-level admin, doubling combined depth to ~2000.
3. Call `isAdminOfHat(user, hatId)` or `getImageURIForHat(hatId)` on the deep tree; observe revert from gas exhaustion.
4. Any logic depending on these functions (admin checks, minting, image URIs) reverts for those hats.
**How found:** Code review of recursive traversal in isAdminOfHat and sibling functions; noticed no iteration/depth bound and reasoned gas scales with linked-tree depth.
**Escalation:** Linking top hats across trees compounds depth, doubling gas cost and suddenly bricking previously working hats.
**Insight:** When auditing tree/graph traversal in Solidity, check whether recursion depth is attacker- or admin-controllable via link/merge operations; a single link can double depth and push gas past block limits, bricking dependent logic.