# OOG / unexpected reverts due to incorrect usage of staticcall.

Tokemak's Balancer reentrancy check staticcalls manageUserBalance without a gas cap, burning 63/64 of forwarded gas on every oracle price call and inflating withdrawal costs ~100x.

- Payout: Contest reward
- Severity: medium
- Program: Tokemak
- Credited: carrotsmuggler
- Disclosed: 2023-06-30
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-06-tokemak-judging/issues/822
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-06-tokemak%3AM-17
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:incomplete-fix technique:source-review vuln:dos vuln:misconfiguration

**Target:** BalancerUtilities.checkReentrancy staticcall to Balancer Vault manageUserBalance
**Root cause:** The reentrancy check staticcalls vault.manageUserBalance without a gas limit; since manageUserBalance always writes storage, the staticcall always reverts and consumes all 63/64 forwarded gas per EIP-150.
**Steps:**
1. Call oracle.getPriceInEth on a Balancer LP pool (e.g. wstETH/cbETH) which routes through BalancerUtilities.checkReentrancy
2. Observe checkReentrancy does `address(vault).staticcall(abi.encodeWithSelector(manageUserBalance.selector, 0))` with no gas cap
3. staticcall hits `_status = _ENTERED` storage write, reverts, burning 63/64 of gas
4. Measure gasleft before/after: ~96% of gas consumed (POC: 9.2e18 -> 4.2e17)
5. Fix: `staticcall{gas: 10_000}(...)` per Balancer VaultReentrancyLib
**How found:** Reading Balancer's own VaultReentrancyLib comments/PR #2467 noting the staticcall always reverts on storage modification and must be gas-capped; compared Tokemak's uncapped usage and confirmed with a Foundry POC measuring gasleft before/after the oracle call.
**Exploitation:** Not an attack; every user withdrawal touching a Balancer destination vault pays ~100x gas overhead (est. 0.07-0.43 ETH per withdrawal), and low gas limits cause OOG reverts blocking withdrawal.
**Insight:** When copying a reentrancy-guard pattern from another protocol, check whether the upstream library caps gas on its staticcall probe; an uncapped probe that always reverts on storage write silently burns 63/64 of gas on every call path that reaches it.