The Cost of Relying on Default Array Handling

Iterating over a dynamic, user-populated array without pagination is a classic gas trap. A single function call can exceed the block gas limit, bricking the contract. This pattern is endemic in NFT airdrops and vesting schedules.

• Gas Cost: Scales O(n) with array size, risking out-of-gas errors.
• Attack Vector: Malicious users can push the array length to censor legitimate transactions.
• Real-World Impact: Crippled early DeFi protocols like MakerDAO's first multi-collateral DAI shutdown mechanism.

Using delete array[index] or .pop() without compaction leaves a gap, forcing future loops to iterate over empty slots. The default delete opcode only zeroes the value, it doesn't shrink the array, wasting gas on every subsequent read.

• Hidden Cost: A loop with 1000 elements and 100 deletions wastes ~210k gas on pointless iterations.
• Correct Pattern: Use a "swap-and-pop" (last element to deleted index) for O(1) deletion.
• Ecosystem Blindspot: Missed by most automated auditors, requiring manual review.

Exposing a full array via a public state variable or a getter that returns storage is a free data feed for MEV bots. They can frontrun any transaction that processes the array based on its state.

• MEV Incentive: Bots monitor for pending txns interacting with the array to sandwich or censor.
• Gas Amplification: Forces users to pay for unbounded storage reads in their function calls.
• Architectural Fix: Return a memory copy, implement pagination, or use mappings with enumerability (like ERC721Enumerable).

Iterating over user-supplied arrays without gas limits is a denial-of-service vulnerability. A single transaction can consume the entire block gas limit, bricking core protocol functions.

• Key Risk: Front-running attacks can force execution on manipulated, large arrays.
• Key Fix: Implement pagination, gas caps, or shift logic off-chain (e.g., Merkle proofs).

Default array.push() in Solidity performs a costly SSTORE on every addition, even for trivial data. This scales O(n) gas costs for batch operations, making protocols like NFT mints or airdrops prohibitively expensive.

• Key Cost: Each push costs ~20k gas for a new slot, plus allocation overhead.
• Key Fix: Use packed storage, mappings, or off-chain computation with single-state root updates.

Deleting an array element via delete array[i] often leaves a gap, requiring a manual shift or maintaining a "dirty" array. The naive pop-and-swap pattern can break index-based lookups critical for protocols like liquidity pools.

• Key Issue: Gaps corrupt enumerations; shifts cost O(n) gas.
• Key Fix: Use mappings to bool for membership and separate index arrays, or adopt a registry pattern like ERC-721A's packed ownership.

Protocols that expose unbounded arrays via view functions force indexers like The Graph to process massive datasets. This leads to sync failures, broken UIs on Etherscan, and reliance on centralized RPC providers for simple queries.

• Key Impact: Degraded UX and hidden centralization.
• Key Fix: Design for indexability: emit events for all state changes and provide paginated RPC endpoints.

Early governance contracts iterated over all proposals for voting power checks. As arrays grew, proposal creation gas costs became untenable (~$1000+), stifling participation. This is a direct cost of on-chain array state expansion.

• Key Lesson: On-chain state is expensive; derivative data should be computed off-chain or via incremental proofs.
• Key Fix: Snapshot voting with on-chain execution via bridges like SafeSnap.

Uniswap v3 stores liquidity in a packed array of ticks. Reading/writing this array naively would be catastrophic. Their solution: a bitmap index to locate the next initialized tick in O(1) time, transforming liquidity search from O(n) to constant gas.

• Key Innovation: Replace iterative search with compact bitmap lookups.
• Key Result: ~5000x gas reduction for swaps crossing multiple ticks.