---
title: "Comment by Lavadera Ruttinger on \"Preventing Denial of Service Attacks in Smart Contracts: Implementing the Withdrawal Pattern\" | Hashnode"
description: "I once inherited a contract where a for-loop over an unbounded array of user addresses was used to distribute rewards—one malicious actor with a tiny balance co"
url: "https://hashnode.com/posts/preventing-denial-of-service-attacks-in-smart-contracts-implementing-the-withdrawal-pattern/67dd7bb9cf09a070e54cd8e9/comment/69f8bd8f4a006d608cad4214"
---

[Discussion](https://hashnode.com/posts/preventing-denial-of-service-attacks-in-smart-contracts-implementing-the-withdrawal-pattern/67dd7bb9cf09a070e54cd8e9)

Comment [Preventing Denial of Service Attacks in Smart Contracts: Implementing the Withdrawal Pattern](https://hashnode.com/posts/preventing-denial-of-service-attacks-in-smart-contracts-implementing-the-withdrawal-pattern/67dd7bb9cf09a070e54cd8e9)

[Lavadera Ruttinger](https://hashnode.com/@ruttinger)

[May 4](https://hashnode.com/posts/preventing-denial-of-service-attacks-in-smart-contracts-implementing-the-withdrawal-pattern/67dd7bb9cf09a070e54cd8e9/comment/69f8bd8f4a006d608cad4214)

I once inherited a contract where a for-loop over an unbounded array of user addresses was used to distribute rewards—one malicious actor with a tiny balance could cause the entire distribution to hit the gas limit and lock all funds. Refactoring to a push-over-pull pattern was the only fix. That silent denial-of-service trap taught me to never trust that storage arrays will stay small.