How Can an Attacker Force an External Call to Return False without Reverting?

An attacker can force an external call to return false without reverting the caller's transaction by having their malicious contract's fallback function consume all the gas forwarded by the call. If the call forwards a large amount of gas, the malicious contract can simply loop until it hits the gas limit.

The external call fails and returns false , but the calling contract might not revert if it doesn't check the return value.

How Do Gas Limitations Prevent Reentrancy in Some Cases?
Can a Contract without a Fallback Function Still Participate in a Reentrancy Attack?
What Is the Difference between Gas Limit and Gas Price?
What Is the Difference between a Receive and a Fallback Function in Solidity?
Can a Contract’s Fallback Function Intentionally Consume More than 2,300 Gas?
How Does a Non-Reverting External Call Return Value Affect Contract Security?
What Is a Denial-of-Service (DoS) Attack Related to Fallback Functions?
Can a Reentrancy Attack Be Performed without a Fallback Function?

Glossar