External call inside a loop

Severity: Low ID: calls-loop

Flags external calls made from inside loops, including calls reached through modifiers or internal helper functions.

What it does

Reports high-level contract calls, low-level call/delegatecall/staticcall, Ether send/transfer, external self-calls through this, and contract creation inside a loop. Internal and private library calls and super dispatch are not treated as external calls.

Why is this bad?

External calls inside loops can turn one reverting or gas-heavy callee into a denial-of-service for the whole loop. This is especially risky for push-payment patterns where every recipient must accept ETH or where every external contract must respond successfully before the function can complete.

Example

Bad

contract Payouts {
    address payable[] recipients;

    function payAll() external payable {
        for (uint256 i; i < recipients.length; ++i) {
            recipients[i].transfer(1 ether);
        }
    }
}

Good

contract Payouts {
    mapping(address recipient => uint256 amount) public claimable;

    function claim() external {
        uint256 amount = claimable[msg.sender];
        claimable[msg.sender] = 0;
        payable(msg.sender).transfer(amount);
    }
}