Denial-of-Service Gas-Limit Pattern Scanner

WHAT IT DOES

Denial-of-Service Gas-Limit Pattern Scanner is a security-focused tool that scans Solidity contracts for patterns that could lead to Denial-of-Service (DoS) attacks through gas limit exhaustion. It takes contract source code from the user and analyzes it for loops, array iterations, unbounded operations, and gas-intensive patterns. The tool identifies critical patterns including for loops over unbounded arrays, while loops without bounded conditions, functions that return entire arrays, mappings used with loops, and array push/delete operations inside loops. Each finding is classified by severity (critical, high, medium, low, or info) based on the potential for gas exhaustion. The tool provides detailed descriptions of each vulnerability, the exact location in the source code, and actionable recommendations for remediation. This enables developers to identify and fix DoS gas-limit vulnerabilities before deployment.

HOW TO USE

Paste your Solidity contract source code into the input area. Click "Scan for DoS patterns" to analyze the code. The tool will display a summary showing counts of critical, high, medium, and low severity issues. Each vulnerability entry includes the name, severity, description, location (line number and context), and a recommendation for fixing the issue. The scan report can be copied or downloaded as JSON for further analysis.

TECHNICAL NOTE: DOS PATTERN DETECTION AND CLASSIFICATION

The tool uses regex-based pattern matching to detect DoS gas-limit patterns in Solidity source code. It scans for for loops, while loops, array length iterations, functions returning entire arrays, mappings used with loops, and gas-intensive operations inside loops. Each pattern is mapped to a severity level based on the potential for gas exhaustion: critical for unbounded array iterations and loops over mappings, high for unbounded while loops and unbounded array length iterations, medium for returning entire arrays and gas-intensive operations inside loops, and low for informational findings. The tool also detects push/delete operations inside loops and loops with sender checks or block timestamp usage.

WHAT IT CANNOT SEE

The tool cannot detect all DoS gas-limit issues without context; some patterns may be safe depending on the specific application logic and array sizes. It is limited to the accuracy of the source code analysis; syntax variations may cause false positives or negatives. It cannot detect issues in external contracts or libraries that are imported into the contract. It cannot verify if a DoS pattern is actually exploitable in the specific deployment environment. The tool is limited by the parser's ability to handle Solidity syntax variations, including newer language features. It cannot scan for DoS patterns on non-EVM chains.

PLEASE NOTE

This tool is designed exclusively for Solidity contracts on EVM-compatible chains. It does not support other smart contract languages. The scan results are based on static analysis and may produce false positives or miss some issues. Always verify the findings with manual review and testing. The tool is read-only and does not modify any state. The tool provides no warranty that the scan results are complete or accurate; users are responsible for validating all findings and implementing appropriate fixes.