Denial of service by gas or unbounded operations

What it is

Iterating an array whose length users control means the gas cost of the function grows with usage. Past a point the call cannot fit in a block and the function becomes permanently uncallable. A related pattern: a loop that pushes payments halts on the first recipient whose receive() reverts.

Why it matters

Correct code that has become impossible to call. Funds can be locked forever, and one hostile participant can deliberately grief everyone else by making their own payment fail.

The vulnerable pattern

One reverting recipient blocks every payout.

for (uint256 i = 0; i < investors.length; i++) {
    payable(investors[i]).transfer(amounts[i]);
}

The fix, in code

Each recipient claims independently.

function claim() external nonReentrant {
    uint256 amount = owed[msg.sender];
    require(amount > 0, "nothing owed");
    owed[msg.sender] = 0;
    (bool ok, ) = msg.sender.call{value: amount}("");
    require(ok, "transfer failed");
}

How to fix it

• Replace push payments with pull payments.
• Bound every loop, or paginate over an explicit range the caller supplies.
• Never let an external call inside a loop decide whether the whole batch succeeds.

How it is detected

Every audit on EVM Smart Audit checks for SWC-128 and reports it as passed or flagged in the standards coverage grid — so the report tells you it was checked even when nothing was found. See the detector suite for what else runs alongside it, or the full database for the other 21 checks.