Avoiding Smart Contract “Gridlock” with Slither

Summary: A denial-of-service vulnerability dubbed 'Gridlock' was publicly reported on July 1st in an Edgeware smart contract deployed on Ethereum, which may have processed as much as $900 million worth of Ether. The bug was a strict equality assertion in the lock() function that assumed a newly created Lock contract had zero Ether balance, letting an attacker pre-send Wei to the pre-calculated contract address and force the assertion to fail in all future transactions.
Why it matters: The attack cost only a few Wei to execute against a contract that may have handled $900 million in Ether, and the fix was a single character change from '==' to '>='. Trail of Bits' Slither detector for this pattern has been public since version 0.5.0 on January 14th, 2019, so the question is whether your Solidity review process runs it.

Read the original at Trail of Bits Blog ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026