# Sui Temporary Total Network Shutdown Bugfix Review

Narwhal get_certificates lacked digest-count limits and timeouts, letting a single 37MB request with 1.2M digests OOM-crash Sui validators and halt the network.

- Payout: $50,000
- Severity: high
- Program: Sui
- Credited: F4lt
- Disclosed: 2023-10-13
- Write-up quality: 7/10
- Original: https://immunefi.com/blog/bug-fix-reviews/sui-network-shutdown/
- Library page: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-sui-network-shutdown
- Tags: domain:network domain:web3 impact:dos kind:bounty platform:blog platform:immunefi sev:high tech:rust technique:source-review vuln:dos

**Target:** Narwhal primary get_certificates RPC handler on Sui validator nodes
**Root cause:** The get_certificates handler extracted all digests from the request and flattened every corresponding certificate into one vector without limiting the number of digests or enforcing read timeouts, so memory scaled with attacker-controlled request size.
**Steps:**
1. Set up a local testnet with validator nodes (sui-node --config-path validator-config-0.yaml etc.).
2. Craft a batch of malicious certificates and build a request containing ~1,200,000 digests (~37MB payload).
3. Send the request to a validator's Narwhal get_certificates endpoint over a single connection.
4. Observe validator memory grow as it loads certificates until OOM; connection drops with `unknown error: connection lost`.
5. Repeat against enough validators to crash the network.
**How found:** Whitehat reviewed the Narwhal primary get_certificates logic and noticed no cap on response digests and no timeout during digest reading, hypothesizing memory amplification via large certificates.
**Exploitation:** Attacker sends one oversized get_certificates request (37MB, 1.2M digests) to validator nodes; each validator flattens up to 41KB certificates per digest into memory, exhausting 64GB RAM and triggering OOM, crashing validators and causing a temporary total network shutdown.
**Escalation:** Single request per validator; crashing a quorum of validators halts the entire chain rather than one node.
**Insight:** In consensus/mempool RPCs, look for handlers that flatten unbounded client-supplied ID lists into responses; measure per-item serialized size (here 41KB/cert) to compute amplification and test with a single oversized request.