Denial-of-Service via Unbounded Loop Scanner

WHAT IT DOES

This tool connects to your EVM wallet and scans smart contract source code for unbounded loops that could lead to denial-of-service (DoS) attacks via gas exhaustion. It identifies for loops, while loops, and dynamic array iterations where the loop bound depends on external input or mutable state. The tool flags patterns where loop length can be manipulated by attackers to consume excessive gas and cause transactions to revert.

HOW TO USE

Connect your Web3 wallet using the Connect button. Paste your contract source code in the Contract Source Code field. Click "Scan for DoS" to analyze the code for unbounded loops and gas-exhaustion patterns. Click "Load Sample" to populate fields with an example contract containing various loop patterns. Results appear in the Results card with a summary of loops found, unbounded loops detected, and risk level (High, Medium, or Low), followed by a detailed breakdown of each loop with its type, line number, and bound status.

TECHNICAL MECHANISM: LOOP BOUND ANALYSIS AND GAS EXHAUSTION DETECTION

The tool uses regular expression pattern matching to identify loop structures in Solidity source code. It detects for loops and while loops, then analyzes their bounds and body for potential unbounded patterns. Key indicators include iterations over arrays with .length that can be manipulated, loops over dynamic data structures that grow over time, and while loops with conditions that may never terminate. The tool also checks for common patterns like loops over user lists, token holders, or other enumerable collections. Each loop is classified as bounded (fixed or limited range) or unbounded (potentially infinite or attacker-controlled). The risk level is determined by the presence of unbounded loops, which can lead to gas exhaustion and DoS.

WHAT IT CANNOT SEE

This tool cannot dynamically execute contracts to test for gas exhaustion—it performs static analysis only. It cannot determine if unbounded loops will actually cause DoS without runtime context—the impact depends on actual gas consumption and contract state. It cannot guarantee that flagged loops are exploitable—some unbounded loops may be safe in practice. It relies on source code parsing and may produce false positives or miss complex patterns. It cannot analyze contracts with obfuscated or highly optimized code—the tool works best with readable source code. It cannot detect loops that are bounded but still consume excessive gas due to complex operations inside the loop.

PLEASE NOTE

This is a read-only tool—it never signs transactions. All data is processed in-memory and never persists. The tool supports EVM chains only—Ethereum, Polygon, BSC, Arbitrum, Optimism, Avalanche, Base, and Fantom. Unbounded loops are a serious DoS vector—use this tool as a starting point for security review, not as a final audit. Always conduct thorough gas testing and consult security professionals.