# Unbounded array growth bricks iteration

Arrays appended per action or per user, later iterated or deleted in full, with attacker-controllable length

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2025-07-07. Updated 2026-10-25._

## How it works
An array grows by one entry per state change, and some later path touches every entry in a single transaction. The code assumes the array stays small, but its length is attacker-controllable: entries are cheap to add, or can be added on someone else's behalf. Once the array is large enough, the full iteration or full `delete` exceeds the block gas limit and reverts. The broken assumption is that array size is bounded by honest usage; nothing enforces a cap, batching, or a skip for no-op entries.

## Where it shows up
- A push into a per-user or per-entry array inside a function that accepts an arbitrary beneficiary or `to` address [E2](https://bugbountylibrary.com/r/c4%3A2023-03-mute%3AH-03.md).
- A push on every state transition, including same-block transitions with zero time delta [E1](https://bugbountylibrary.com/r/c4%3A2023-10-canto%3AH-01.md).
- A `while`/`for` loop over the whole array in a user-facing mint, burn, redeem, or harvest path [E1](https://bugbountylibrary.com/r/c4%3A2023-10-canto%3AH-01.md)[E2](https://bugbountylibrary.com/r/c4%3A2023-03-mute%3AH-03.md).
- A single `delete` of a whole queue array in one transaction [E3](https://bugbountylibrary.com/r/c4%3A2025-04-kinetiq%3AM-05.md).
- Entry cost that is tiny or refundable, so flooding is cheap [E3](https://bugbountylibrary.com/r/c4%3A2025-04-kinetiq%3AM-05.md).

## How to review
Find every array that is appended to and later iterated or cleared. For each, ask: who controls the length, what does one entry cost the attacker, and what is the gas of the full pass at realistic length? The invariant that must hold: no user-facing or processing path does work proportional to an attacker-influenceable, uncapped array. Safe designs cap length, batch processing, skip zero-delta entries, or use mappings plus explicit index lists. Check view functions too, since they can be bricked the same way [E2](https://bugbountylibrary.com/r/c4%3A2023-03-mute%3AH-03.md).

## Variants seen
- Same-block tick crossings push entries despite zero time delta, then an unbounded accrual loop reverts [E1](https://bugbountylibrary.com/r/c4%3A2023-10-canto%3AH-01.md).
- `LockTo` lets anyone append to a victim's lock array, blocking that victim's redemptions [E2](https://bugbountylibrary.com/r/c4%3A2023-03-mute%3AH-03.md).
- Cheap minimum deposits grow a pending queue until the whole-array `delete` exceeds the gas limit [E3](https://bugbountylibrary.com/r/c4%3A2025-04-kinetiq%3AM-05.md).

## Impact and severity
Minting, burning, harvesting, redemptions, or L1 processing revert for most or all users, effectively permanent until the array shrinks. Severity is high when the block is permanent and cheap to trigger [E1](https://bugbountylibrary.com/r/c4%3A2023-10-canto%3AH-01.md)[E2](https://bugbountylibrary.com/r/c4%3A2023-03-mute%3AH-03.md); medium when it is a partial DoS on one processing path [E3](https://bugbountylibrary.com/r/c4%3A2025-04-kinetiq%3AM-05.md). It worsens when the array is per-victim (targeted) or when no reset path exists.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-10-canto%3AH-01.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-03-mute%3AH-03.md
- E3: https://bugbountylibrary.com/r/c4%3A2025-04-kinetiq%3AM-05.md