# fulfillRandomWords() could revert under certain circumstances

LooksRare Infiltration's fulfillRandomWords() can exceed Chainlink VRF's 2.5M gas cap when many agents are wounded, reverting and permanently DoSing the game.

- Payout: Contest reward
- Severity: medium
- Program: Looksrare
- Credited: ge6a
- Disclosed: 2023-10-18
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-10-looksrare-judging/issues/136
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-10-looksrare%3AM-4
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:dos

**Target:** Infiltration game contract, Chainlink VRF fulfillRandomWords callback
**Root cause:** fulfillRandomWords() iterates over wounded agents and performs unbounded work; with a higher AGENTS_TO_WOUND_PER_ROUND_IN_BASIS_POINTS value the callback gas exceeds Chainlink VRF's 2,500,000 limit and reverts.
**Steps:**
1. Set AGENTS_TO_WOUND_PER_ROUND_IN_BASIS_POINTS to 30 in test setup
2. Start game and draw one round via `_startGameAndDrawOneRound()`
3. Draw 48 rounds with `_drawXRounds(48)` to accumulate wounded agents
4. Collect up to 30 wounded agent IDs across rounds 2-6 via `getRoundInfo`
5. Mint HEAL_BASE_COST*30 LOOKS to user1, approve TRANSFER_MANAGER, call `infiltration.heal(wa)`
6. Draw one more round with `_drawXRounds(1)` and observe fulfillRandomWords gas exceeds 2,500,000 and reverts
**How found:** Researcher read Chainlink VRF docs noting the 2.5M gas cap on fulfillRandomWords, then reasoned that the wound-count parameter scales loop work in the callback and built a Foundry PoC with --gas-report to confirm the limit is exceeded.
**Exploitation:** No attacker action; the protocol itself triggers the revert when enough agents are wounded in a round, halting the game until emergencyWithdraw after ~36h.
**Insight:** For any Chainlink VRF consumer, check that the fulfillRandomWords callback's work is bounded by a configurable parameter; if a governance-settable value scales loop iterations, the callback can be pushed past the 2.5M gas cap and permanently brick the randomness flow.