# Unmetered resource exhaustion in contracts

Host imports, hooks, or loops that do unbounded or unmetered work reachable from user input

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2026-08-20. Updated 2026-10-25._

## How it works
A resource that should be priced or bounded is instead free or capped per-unit while the caller can multiply it. The assumption that breaks: that a per-call or per-contract limit bounds total work. When user-controlled input drives a loop, a host import, or a hook that runs inline on every state change, the real cost is the product of the cap and the number of invocations, and nothing meters that product. The result is CPU or memory exhaustion that halts a node, blocks a settlement, or disables a liquidation.

## Where it shows up
- WASM/VM host imports that skip a gas-metering call their siblings make [E1](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-14.md)
- Per-asset or per-contract caps that compose across multiple hooks in one high-level operation [E2](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-40.md)
- Loops inside settlement or callback paths that recompute invariant data each iteration [E3](https://bugbountylibrary.com/r/c4%3A2025-11-megapot%3AH-02.md)
- User-deployable programs or parameters that reach expensive host functions directly [E1](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-14.md)
- Inline side effects on every token movement, multiplied by router operations [E2](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-40.md)

## How to review
For every host import, diff it against its siblings and confirm each calls the metering function [E1](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-14.md). For every per-unit cap, count how many times one user-triggered operation invokes the capped path and multiply; the invariant is that worst-case aggregate work stays under the chain's CPU/gas budget [E2](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-40.md). For settlement and callback loops, check whether inner loops recompute data that could be cached, and measure gas at realistic parameters against the target chain's limit [E3](https://bugbountylibrary.com/r/c4%3A2025-11-megapot%3AH-02.md). The property that must hold: total metered cost of any user-reachable path is bounded and charged, not flat or free.

## Variants seen
- Missing metering on a single host import, giving free loops and huge writes [E1](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-14.md)
- Per-token cap multiplied across four liquidation hooks, exceeding CPU budget [E2](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-40.md)
- Redundant subset regeneration inside a bonusball loop, exceeding the L2 gas limit [E3](https://bugbountylibrary.com/r/c4%3A2025-11-megapot%3AH-02.md)

## Impact and severity
High: chain halt from validator exhaustion [E1](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-14.md), blocked collateral seizure [E2](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-40.md), and permanently blocked jackpot settlement [E3](https://bugbountylibrary.com/r/c4%3A2025-11-megapot%3AH-02.md). Severity rises when the path is permissionless and the cost is paid by the protocol rather than the caller, and when L2 gas ceilings are low.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-14.md
- E2: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-40.md
- E3: https://bugbountylibrary.com/r/c4%3A2025-11-megapot%3AH-02.md