# Unbounded external call or nil deref strands state

Awaited calls with no timeout, or decoded fields dereferenced before nil check, on synchronous paths

_Area: Smart contract access control and control flow. Seen in 2 disclosed reports; latest 2026-06-05. Updated 2026-10-25._

## How it works
A single awaited external call or field dereference is assumed to complete or return a valid value. When that assumption breaks, the caller blocks forever or panics. Two shapes share this root: (1) a call with no timeout, so a stalled peer leaves the caller waiting indefinitely; (2) a decoded message whose sub-field is omitted on the wire, decoding to nil, then dereferenced with no guard. In both cases nothing bounds the wait and nothing catches the failure, so the process or the state it guards is stranded.

## Where it shows up
- Convenience HTTP helpers (e.g. `reqwest::get()`) whose builder defaults leave `timeout` and `read_timeout` as `None` [E2](https://bugbountylibrary.com/r/cantina%3Acitrea_jul2025%3A3.2.5.md)
- Awaited external calls on startup or queueing paths where a stall blocks unrelated work [E2](https://bugbountylibrary.com/r/cantina%3Acitrea_jul2025%3A3.2.5.md)
- Protobuf sub-messages dereferenced before a nil check; omitted fields decode to nil [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-rm5c-5x2p-48wr.md)
- Synchronous gossip/topic validators with no `recover()` around the callback [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-rm5c-5x2p-48wr.md)

## How to review
Trace each external call and each decoded message to its first use. Two invariants: every awaited call on a critical path has a finite timeout, and every pointer or sub-message is nil-checked before dereference. For Rust, open the builder defaults and confirm a timer future is actually polled [E2](https://bugbountylibrary.com/r/cantina%3Acitrea_jul2025%3A3.2.5.md). For Go P2P paths, confirm the topic-validator callback has a `recover()` so a panic cannot kill the process, and that the first field access is guarded [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-rm5c-5x2p-48wr.md).

## Variants seen
- No HTTP timeout on a fee-fetch client freezing sequencer startup and DA queueing [E2](https://bugbountylibrary.com/r/cantina%3Acitrea_jul2025%3A3.2.5.md)
- Nil dereference of an omitted protobuf field panicking a P2P validator [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-rm5c-5x2p-48wr.md)

## Impact and severity
High: node crash and potential chain halt [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-rm5c-5x2p-48wr.md), indefinite sequencer freeze [E2](https://bugbountylibrary.com/r/cantina%3Acitrea_jul2025%3A3.2.5.md). Severity rises when the path is unauthenticated and synchronous, so one request or one malformed message is enough.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-rm5c-5x2p-48wr.md
- E2: https://bugbountylibrary.com/r/cantina%3Acitrea_jul2025%3A3.2.5.md
- E3: https://bugbountylibrary.com/r/cantina%3Acitrea_jul2025%3A3.2.8.md