Use pull payments when you want to reduce exposure to gas uncertainty and avoid forcing recipient logic to execute inside a constrained transfer path. Pull designs let recipients claim funds through a separate call, which gives more control over gas usage and reduces the chance that a fixed stipend will break delivery. It is a safer pattern when contract logic is complex or gas sensitive.
When pull payments make more sense than push payments
Pull payments are the better choice when the recipient side may be expensive, variable, or sensitive to gas limits, because the transfer is no longer trying to execute recipient logic in the same transaction that creates the obligation. That separation matters most when the payout is part of a larger workflow and failure to deliver funds would be more damaging than requiring the recipient to claim them later.
The strongest practical signal is complexity at the destination. If the recipient may be a contract with non-trivial fallback behaviour, or if the payout path could become brittle under changing gas conditions, pull payments reduce coupling between settlement and delivery. They also make it easier to reason about failure, because the contract can record an owed balance without depending on immediate execution success.
For developers, the main architectural advantage is control. A pull design lets the recipient choose when to collect, which means the receiving side can supply the gas it needs, retry safely, and handle its own business logic outside the sender’s critical path. That is especially useful in systems that must keep working even if the recipient is temporarily unavailable, overloaded, or unexpectedly expensive to call.
Failure modes that push designs are trying to avoid
Push payments are more fragile because they assume the recipient can accept funds inside the sender’s execution context. If that assumption is wrong, the whole payment flow may fail, stall, or become dependent on a fixed stipend that is too small for real-world recipient logic. In practice, that creates avoidable brittleness whenever the receiving address is a contract rather than a simple externally owned account.
Pull patterns also reduce the blast radius of a bad recipient implementation. When the sender hands off value through a separate claim step, the sender is less exposed to reverts, gas surprises, or accidental coupling to code it does not control. That does not remove the need for careful accounting, but it does keep delivery failure from contaminating the upstream action that created the balance.
Failure mechanism: A push transfer can revert or become unreliable when the recipient path needs more gas than the sender’s transfer mechanism provides, or when the recipient’s logic is unexpectedly complex.
Impact: Payments may fail, transactions may become brittle across protocol or gas changes, and a single awkward recipient can disrupt an otherwise valid workflow.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS 4 — Secure Configuration of Enterprise Assets and Software | Pull payments reduce brittle transfer behavior under changing gas conditions. |
| Recommendation — Review payment code paths for brittle assumptions and hardcoded transfer limits. | ||
| NIST CSF 2.0 | PR.AC — Access Control | Claim-based payouts limit who can execute the delivery step and when. |
| Recommendation — Separate obligation creation from value transfer to constrain execution risk. | ||
| MITRE ATT&CK | T1606 — Forge Web Credentials | Smart contract payout abuse often centers on exploiting trusted execution paths and call assumptions. |
| Recommendation — Harden trusted call paths and validate assumptions before transferring value. | ||
Practitioner Guidance
What to verify: Check whether the recipient is always a simple account or could ever be a contract, because that determines whether immediate delivery is genuinely safe. If the recipient type can vary, treat push payments as the higher-risk default and require a clear reason to use them.
Decision rule: If the payout must never depend on recipient execution success, prefer a claim-based design; if immediate settlement is essential and the recipient is tightly controlled, push payments may still be acceptable with explicit review of the call path.
Common mistake: Designing for the happy path only. Teams often test with simple recipients and overlook that production recipients, integrations, or future upgrades can add logic that makes a fixed-stipend transfer fail.
Practitioner takeaway: Use pull payments when delivery safety matters more than instant transfer, because separating obligation from collection is usually the more resilient choice whenever recipient-side execution cannot be assumed to stay simple.
Related resources from NHI Mgmt Group
- Why do authorised push payments increase fraud risk compared with pull payments?
- When should teams prefer enterprise AI contracts over consumer chat tools?
- Why do organisations prefer tenant local Azure management models over legacy tools that pull data into a vendor system?
- When should organisations prefer standards over custom implementations?
