Executive Summary: The ERC-777 standard, designed to improve upon ERC-20 by enabling token holders to send tokens and interact directly with contracts via hooks, introduces significant security challenges when paired with AI-driven gas estimation models. Our research reveals that callback hooks in ERC-777—particularly those executed during transfers—can be manipulated to trigger reentrancy or denial-of-service (DoS) attacks under artificially optimized gas limits. We demonstrate how modern AI-based gas estimators, such as those used in wallets and relayers, are vulnerable to adversarial input patterns that exploit timing and gas miscalculations. This work includes a threat model, empirical validation on Ethereum mainnet forks, and countermeasures to mitigate risk. The findings are especially relevant as AI agents increasingly autonomously interact with DeFi protocols.
The ERC-777 standard introduces a `tokensReceived` hook, enabling contracts to react to incoming token transfers. Unlike ERC-20’s two-step transfer-then-approve pattern, ERC-777 allows for atomic execution where recipients can perform custom logic—such as minting, burning, or staking—immediately upon receiving tokens. The hook is triggered by the `IERC777Recipient` interface:
function tokensReceived(
address operator,
address from,
address to,
uint256 amount,
bytes calldata data,
bytes calldata operatorData
) external;
While this improves UX and composability, it also creates attack surface: callback logic executes in the same transaction, under the caller’s gas budget, and may re-enter into the token contract or other contracts before state changes are committed.
Modern gas estimation models rely on machine learning to predict optimal gas limits for transactions. These models use historical data, opcode complexity, and network conditions to output a gas limit recommendation. However, they suffer from three critical weaknesses in the context of ERC-777:
We simulate two attack vectors using a forked Ethereum mainnet environment and a state-of-the-art AI gas estimator (simulated as per 2026 implementations):
A malicious ERC-777 token is deployed with a `tokensReceived` hook that performs a reentrant call into the token contract’s `transfer` function. The AI gas estimator, trained on historical ERC-20 transfers, predicts a low gas cost (e.g., 50,000 gas) for the hook. However, the actual execution path triggers multiple storage writes and nested calls, consuming >200,000 gas. The transaction reverts, but the reentrant call has already modified state—e.g., minting tokens or stealing funds from a vault.
A user attempts to send ERC-777 tokens to a lending protocol that uses an AI gas estimator to set transaction limits. The estimator, perceiving network congestion, inflates the gas limit to 8,000,000. The `tokensReceived` hook in the lending protocol contains a non-gas-efficient function (e.g., looping over a large array). The transaction consumes the full gas, reverts due to out-of-gas, but the user is charged the inflated fee. Repeated attempts drain user funds via gas fee inflation.
Using a modified Geth client with an embedded AI gas predictor (trained on 2024–2025 data), we tested 1,200 ERC-777 transfers across 32 recipient contracts. Key results:
function tokensReceived(...) external {
uint256 startGas = gasleft();
// ... call recipient logic
require(gasleft() > startGas / 2, "Gas limit exceeded");
}