# ProcessWithdrawals is still DOS-able

Malicious contract as withdrawal recipient consumes all gas in processWithdrawals, permanently bricking the withdrawal queue and burning users' VUSD.

- Payout: Contest reward
- Severity: high
- Program: Hubble Exchange
- Credited: 0x3e84fa45
- Disclosed: 2023-04-16
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-04-hubble-exchange-judging/issues/116
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-04-hubble-exchange%3AH-1
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:incomplete-fix technique:source-review vuln:dos

**Target:** VUSD withdrawal queue (processWithdrawals)
**Root cause:** processWithdrawals forwards all remaining gas to each recipient via external call; a recipient contract that burns >30M gas makes the whole batch exceed the block gas limit, so the call always reverts.
**Steps:**
1. Deploy MaliciousReceiver with a receive() that loops ~150k iterations (~30M+ gas).
2. Mint VUSD and call `husd.withdrawTo(address(r), amount)` to enqueue the malicious recipient.
3. Anyone calls `husd.processWithdrawals()`; the external call to r consumes >30M gas.
4. On mainnet (30M block gas limit) the tx always reverts with OutOfGas, so the queue head never advances.
5. Verify with `forge test --gas-limit 30000000` — test fails with EvmError: OutOfGas.
**How found:** Prior code4rena audit reported a DOS on processWithdrawals; researcher noticed the fix only raised the cost, then reasoned that a recipient contract burning gas via receive() is a cheaper permanent DOS.
**Exploitation:** Attacker only needs to enqueue one withdrawal to a gas-burning contract; every subsequent processWithdrawals call reverts, freezing the queue and burning all queued VUSD permanently.
**Insight:** When a batch loop makes external calls with all remaining gas, a single recipient that burns gas can exceed the block gas limit and permanently brick the queue — check whether gas is capped per call.