Tempo shipped a correctness-critical bug fix for TIP20 that prevents out-of-gas errors from silently masking contract initialization state, eliminating a vector for accidental re-initialization of deployed contracts.

> impact

Tempo merged a fix to its TIP20 implementation that addresses how out-of-gas (OOG) errors are handled inside the `is_initialized` check. Before this patch, if an OOG condition occurred during the initialization status lookup, the error was silently swallowed — causing the function to return `false` (uninitialized) even when the contract had already been deployed and initialized. The fix ensures that OOG errors are properly propagated up the call stack rather than being caught and discarded. This matters because TIP20 initialization guards are a foundational safety mechanism. When `is_initialized` incorrectly reports `false` due to a masked OOG error, downstream logic could allow a contract to be re-initialized — overwriting state, resetting ownership, or draining funds. This is the kind of silent failure that doesn't show up in normal testing (where gas is plentiful) but becomes exploitable under adversarial conditions where an attacker deliberately constrains gas to trigger the faulty code path. The impact is straightforward but significant: any TIP20-compliant contract on Tempo that relies on the initialization guard is now safe from this class of OOG-based re-initialization attacks. If you've deployed TIP20 contracts on Tempo, you don't need to redeploy — the fix is at the runtime level — but you should verify your contracts behave correctly under low-gas scenarios in your test suites going forward. This is a good reminder that error handling in blockchain contexts is security-critical, not just a convenience.

> Try this now

try this

# Walkthrough: Understanding the OOG error propagation fix in TIP20's is_initialized
#
# Before the fix, the is_initialized check looked something like this:
#
# fn is_initialized(contract_addr: Address) -> bool {
#     // Attempt to read the initialization flag from storage
#     match storage_read(contract_addr, INIT_SLOT) {
#         Ok(value) => value != 0,
#         Err(_) => false   // <-- BUG: OOG errors land here too!
#     }
# }
#
# The problem: Err(_) catches *all* errors, including OutOfGas.
# When gas runs out mid-read, the function returns false ("not initialized"),
# which lets initialization logic run again on an already-live contract.
#
# After the fix, OOG is explicitly propagated:
#
# fn is_initialized(contract_addr: Address) -> Result<bool, Error> {
#     match storage_read(contract_addr, INIT_SLOT) {
#         Ok(value) => Ok(value != 0),
#         Err(Error::OutOfGas) => Err(Error::OutOfGas),  // <-- Propagate OOG!
#         Err(_) => Ok(false)  // Other read failures still treat as uninitialized
#     }
# }
#
# To test this in your own TIP20 contracts, simulate a low-gas call:
#
# #[test]
# fn test_oog_does_not_mask_initialization() {
#     let contract = deploy_tip20_contract();
#     initialize_contract(&contract);
#
#     // Simulate a call with barely enough gas to enter is_initialized
#     // but not enough to complete the storage read
#     let result = call_with_gas_limit(
#         &contract,
#         "is_initialized",
#         gas_limit: 200,  // artificially low
#     );
#
#     // After the fix, this should return an OOG error,
#     // NOT a successful `false` response
#     assert!(result.is_err());
#     assert_eq!(result.unwrap_err(), Error::OutOfGas);
#
#     // Critically, a re-initialization attempt under low gas should also fail
#     let reinit_result = call_with_gas_limit(
#         &contract,
#         "initialize",
#         gas_limit: 200,
#     );
#     assert!(reinit_result.is_err());  // Must NOT succeed
# }
#
# Key takeaway: never use catch-all error handling around storage reads
# in initialization guards. OOG is not "data not found" — it's "I couldn't
# finish looking." Treating those the same is a security vulnerability.