# Gas forwarding griefing in contracts

Fixed or all-gas grants that ignore EIP-150 63/64, starving callbacks, stores, or inner calls

_Area: Smart contract access control and control flow. Seen in 51 disclosed reports; latest 2025-10-21. Updated 2026-10-23._

## How it works
The EVM never forwards all requested gas: EIP-150 keeps 1/64 in the caller and subtracts CALL base, cold-access and memory costs first. Two opposite failures follow. Under-forwarding: code promises a callee a minimum, but the callee gets less, so the call reverts and state (withdrawals, failure records) never commits [E2](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-16.md)[E3](https://bugbountylibrary.com/r/sherlock%3A2023-03-optimism%3AH-1.md). Over-granting: a re-entrant path hands out a fixed gas amount that never shrinks with depth, so recursion is unbounded [E1](https://bugbountylibrary.com/r/c4%3A2024-11-nibiru%3AH-06.md). A third shape is the caller choosing the split: a permissionless wrapper lets an attacker starve an inner call into a catch block while the outer tx succeeds [E7](https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.2.1.md).

## Where it shows up
- Hardcoded gas constants on precompile or callback re-entry paths [E1](https://bugbountylibrary.com/r/c4%3A2024-11-nibiru%3AH-06.md)[E8](https://bugbountylibrary.com/r/sherlock%3A2025-06-symbiotic-relay%3AM-6.md).
- Gas assertions placed before storage writes and call setup, ignoring intervening opcodes [E3](https://bugbountylibrary.com/r/sherlock%3A2023-03-optimism%3AH-1.md).
- Buffers smaller than `gasLimit/64`, or min-gas checks ignoring CALL base and EIP-2929 cold cost [E2](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-16.md)[E3](https://bugbountylibrary.com/r/sherlock%3A2023-03-optimism%3AH-1.md).
- User-supplied gas added to a hardcoded relay constant, unvalidated against the fee estimate [E5](https://bugbountylibrary.com/r/c4%3A2024-01-decent%3AH-02.md).
- External call before persisting failure state, with only 1/64 left for the store [E2](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-16.md).
- Permissionless wrapper around a critical call in try/catch [E7](https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.2.1.md).
- Related: cross-VM dispatch reusing the parent gas meter instead of a fresh bounded one [E4](https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-06.md).

## How to review
For each external call, compute what the callee actually gets: `gasleft()` minus CALL base (9000 with value, less 2300 stipend, new-account, memory expansion), minus cold-access cost, times 63/64. Then check:
- Invariant: the callee receives at least the promised minimum, and the caller retains enough for post-call SSTOREs to commit [E2](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-16.md)[E3](https://bugbountylibrary.com/r/sherlock%3A2023-03-optimism%3AH-1.md).
- Count every opcode between the gas assertion and the call [E3](https://bugbountylibrary.com/r/sherlock%3A2023-03-optimism%3AH-1.md).
- For re-entrant paths, confirm the grant shrinks with depth rather than being fixed [E1](https://bugbountylibrary.com/r/c4%3A2024-11-nibiru%3AH-06.md).
- For permissionless wrappers, confirm an attacker cannot pick a gas limit that OOGs the inner call into a success path [E7](https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.2.1.md).
- For precompile staticcalls, confirm the hardcoded stipend covers the target chain's actual pricing [E8](https://bugbountylibrary.com/r/sherlock%3A2025-06-symbiotic-relay%3AM-6.md).

## Variants seen
- Fixed 100k gas on precompile callback enabling infinite recursion and block-production halt [E1](https://bugbountylibrary.com/r/c4%3A2024-11-nibiru%3AH-06.md).
- Gas check before SSTORE/call setup, callee short by up to ~5122 [E3](https://bugbountylibrary.com/r/sherlock%3A2023-03-optimism%3AH-1.md).
- Check ignoring 63/64, under-forwarding at high gas limits [E3](https://bugbountylibrary.com/r/sherlock%3A2023-03-optimism%3AH-1.md).
- 1/64 reserve too small for max payload store, blocking the channel [E2](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-16.md).
- Attacker-chosen gas starving inner call into catch [E7](https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.2.1.md).
- Parent gas meter reused across Cosmos dispatch [E4](https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-06.md).
- Hardcoded 120k pairing stipend below chain pricing [E8](https://bugbountylibrary.com/r/sherlock%3A2025-06-symbiotic-relay%3AM-6.md).

## Why fixes fail
Buffers and checks were added but still omitted intervening opcodes [E3](https://bugbountylibrary.com/r/sherlock%3A2023-03-optimism%3AH-1.md) or the 63/64 rule itself, so the class recurred across reports.

## Impact and severity
Permanent fund lock, bricked withdrawal queues, halted block production, silently skipped account logic [E1](https://bugbountylibrary.com/r/c4%3A2024-11-nibiru%3AH-06.md)[E2](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-16.md)[E3](https://bugbountylibrary.com/r/sherlock%3A2023-03-optimism%3AH-1.md)[E7](https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.2.1.md). High severity: griefing needs little capital and the failure is irreversible once state commits.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-11-nibiru%3AH-06.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-16.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-03-optimism%3AH-1.md
- E4: https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-06.md
- E5: https://bugbountylibrary.com/r/c4%3A2024-01-decent%3AH-02.md
- E6: https://bugbountylibrary.com/r/cantina%3Acitrea_jul2025%3A3.2.2.md
- E7: https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.2.1.md
- E8: https://bugbountylibrary.com/r/sherlock%3A2025-06-symbiotic-relay%3AM-6.md