Fallback functions can run out of gas if they depend on opcodes whose costs have increased. Because transfer() and send() supply a fixed 2300 gas stipend, any added computation pressure can cause the fallback to revert or stop executing. That means ether transfers may fail, dependent business logic may not run, and contracts can behave differently than intended.
Why fixed-gas fallback logic becomes brittle after opcode repricing
A fallback function is only safe when its work stays comfortably inside the gas it receives. When gas costs for opcodes or storage operations rise, code that once fit inside a 2300 gas stipend can start failing even though the source code did not change. The visible symptom is not just a revert, it is a change in contract behaviour at the exact moment value transfer was supposed to be simple and predictable.
The important technical point is that transfer() and send() hard-code that stipend, so they assume the recipient fallback will remain cheap forever. That assumption is fragile because the EVM execution environment can change underneath deployed contracts. If the fallback does logging, state updates, external calls, or even a little extra branching, a gas repricing can turn a working path into a non-working one.
That is why the breakage is usually architectural rather than cosmetic. The transfer may still be attempted, but any dependent logic in the recipient can silently stop running, leaving accounting, notifications, or escrow-style side effects in an incomplete state. In practice, the question is not only whether ether moved, but whether the receiving contract still executed the business rule the sender was relying on.
What actually fails in the call path
The failure mode is easiest to see by separating value delivery from post-transfer behaviour. If the fallback does nothing beyond accepting funds, the stipend may still be enough. Once the fallback needs to read or write storage, emit events, or interact with another contract, it can exceed the stipend and revert. With transfer(), that revert bubbles up and aborts the send. With send(), the call can fail without automatically stopping the caller, which means the failure may be ignored unless the return value is checked.
That difference matters because the calling contract may think it has completed a payout, while the recipient never observed the transfer in the way the system expected. The resulting bug is often a mismatch between financial state and application state. The ether transfer becomes one step, but the broader contract workflow loses atomicity at the application level.
For practitioners, the key design lesson is that gas stipends are not a stable interface for non-trivial logic. They are a narrow compatibility contract, not a guarantee that recipient behaviour will remain valid across network-level gas schedule changes. If a fallback is expected to do real work, that work should not depend on a fixed stipend staying sufficient.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC-4 — Access Permissions and Authorizations | Covers bounded, explicit authorization for contract actions and value-moving calls. |
| Recommendation — Limit value-transfer flows to explicitly authorized and testable execution paths. | ||
| CIS Controls v8 | 16.11 — Application Software Security | Addresses secure handling of application logic that can break under environmental changes. |
| Recommendation — Review application call paths that depend on fixed gas assumptions and remediate brittle logic. | ||
Practitioner Guidance
What to verify: Audit every use of transfer() and send() for recipient code that depends on storage access, event emission, or any logic beyond a trivial accept path. If the fallback must do more than receive funds, treat the stipend as an implementation constraint, not a safety feature.
Decision rule: If the contract must remain reliable across future EVM repricings, do not rely on a fixed-gas transfer path for critical business logic. Use a design that makes success or failure explicit and test the non-happy path, including recipient-side reversion and ignored return values.
What practitioners underestimate: The main risk is not just failed payment, but broken invariants. A payout that appears to succeed while downstream effects are skipped can be harder to detect than an outright revert, especially when the caller does not inspect failure conditions carefully.
Practitioner takeaway: Treat fixed-stipend value transfer as a compatibility shortcut, not a durable contract boundary, because any logic that depends on it can fail the next time gas economics change.
