# activeTransactionBlocks are vulnerable to DDoS attacks

Unbounded activeTransactionBlocks array in Connext removeUserActiveBlocks loop lets attacker spam prepare with 0 amount to permanently DoS any user's block removal.

- Payout: Audit contest
- Severity: high
- Program: Connext
- Found by: gpersoon
- Disclosed: 2021-08-30
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-07-connext-findings/issues/27
- Library page: https://bugbountylibrary.com/r/c4%3A2021-07-connext%3AH-02
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Connext smart contract (removeUserActiveBlocks / prepare)
**Root cause:** removeUserActiveBlocks iterates the entire activeTransactionBlocks array with no upper bound; an attacker can push entries via prepare with 0 amount, growing the array until the loop exceeds block gas limit and can never complete.
**Steps:**
1. Attacker calls `prepare` repeatedly with 0 amount targeting a victim account as router
2. Each call pushes a new entry into the victim's `activeTransactionBlocks` array
3. Array grows unbounded; `removeUserActiveBlocks` for loop over the array eventually exceeds block gas limit
4. Victim can no longer remove blocks / submit valid txs (permanent DoS)
**How found:** Code review of removeUserActiveBlocks for-loop over a dynamic array with no length cap; recognized block gas limit implications and that prepare with 0 amount lets any caller append entries to another user's array.
**Exploitation:** Attacker repeatedly invokes prepare with zero amount to inflate the victim's activeTransactionBlocks array until removeUserActiveBlocks gas cost exceeds block gas limit, bricking the victim's ability to clear blocks and submit transactions.
**Insight:** When a permissionless function appends to a per-user dynamic array that is later iterated in a loop, treat the array length as attacker-controlled and check for unbounded growth / O(n) removal paths.