dos-griefing-analysis

DoS & Griefing Analysis

Detect vulnerabilities that allow attackers to make contracts unusable (Denial of Service) or harm other users at low cost (griefing). These attacks don't steal funds directly but can permanently brick contracts or block critical operations.

When to Use

• Auditing contracts with loops over dynamic arrays or mappings
• Reviewing batch operations (airdrops, reward distribution, liquidation)
• Analyzing contracts that rely on address(this).balance for logic
• Verifying that individual user failures don't block system-wide operations
• Checking for gas-based attack vectors (insufficient gas, storage bloat)

When NOT to Use

• Direct fund theft analysis (use behavioral-state-analysis)
• Access control consistency (use semantic-guard-analysis)
• Reentrancy detection (use reentrancy-pattern-analysis)

Seven DoS & Griefing Vulnerability Classes

Class 1: Unbounded Loop DoS

Loops that iterate over collections that grow with contract usage. As the collection grows, gas cost increases until the function exceeds the block gas limit and becomes permanently uncallable.

// VULNERABLE: Loop over all users — grows forever
address[] public allUsers;

function distributeRewards() external {
    for (uint i = 0; i < allUsers.length; i++) {
        // If allUsers has 10,000+ entries, this exceeds block gas limit
        token.transfer(allUsers[i], calculateReward(allUsers[i]));
    }
}

// SAFE: Paginated processing
function distributeRewards(uint256 startIndex, uint256 batchSize) external {
    uint256 end = min(startIndex + batchSize, allUsers.length);
    for (uint i = startIndex; i < end; i++) {
        token.transfer(allUsers[i], calculateReward(allUsers[i]));
    }
}

// SAFER: Pull pattern
mapping(address => uint256) public pendingRewards;

function claimReward() external {
    uint256 reward = pendingRewards[msg.sender];
    pendingRewards[msg.sender] = 0;
    token.transfer(msg.sender, reward);
}

Detection: