unbounded loop

[pauliax]

function totalSupply() public view returns (uint) {
    return kitties.length - 1;
}

for (uint256 i = 1; i <= totalSupply(); i++) {...}

This loop in the contract can eventually grow so large as to make future operations of the contract cost too much gas to fit in a block. Then, iterating through this large array might consume all the gas provided (run out of gas) and it will never complete.

[adamkolar]

Quoting from the comment of the tokensOfOwnerByIndex function that contains mentioned loop:

    /// @dev This method MUST NEVER be called by smart contract code. It will almost
    ///  certainly blow past the block gas limit once there are a large number of
    ///  Kitties in existence. Exists only to allow off-chain queries of ownership.
    ///  Optional method for ERC-721.

[dete]

Thanks @pauliax. As @adamkolar noted, this function wasn't intended to be called on-chain, but we're also replacing this function as per #4.