2

I've read that when making an external call to an unknown contract, if the contract returns a large amount of random or junk byte it will cause some type of bug. But I dont know exact what it is and how it will be performed.

Can someone provide some more context and/or resources about this attack?

Improve this question

1 Answer 1

Reset to default
3

The general issue is that a regular low-level Solidity call, ie <address>.call(), will automatically copy all bytes returned by the callee to memory.

Note that using memory during an EVM execution costs gas, more specifically you pay gas whenever the memory is expanded.

A possible DOS vector a caller therefore needs to take into account before calling an unknown contract is a returnbomb attack which can lead to the caller running out of gas and the execution to halt.

During such an attack, the callee returns such a big amount of return data that the caller runs out of gas while copying the data into memory.

To prevent such an attack, the caller can use yul/assembly to explicitly decide how much data should be copied to memory.

For more info you may read into nomad-xyz's ExcessivelySafeCall project.

EDIT: To execute such an attack in a local environment, see pcaversaccio's ReturnBombExample.sol gist.

Improve this answer
1
  • @kumar Does this answer your question? If so, could you please mark it as "answered" to help future folks with the same question? If not, anything that's still unclear?
    – merkleplant
    Nov 14 at 7:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.