# Large Validator Sets/Rapid Validator Set Updates May Freeze the Bridge or Relayers

Large or rapidly-updated validator sets make eth_getLogs exceed the 10MB response limit, causing perpetual errors that freeze the Gravity bridge and relayers.

- Payout: Audit contest
- Severity: high
- Program: Althea Gravity Bridge
- Found by: nascent
- Disclosed: 2021-08-19
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-08-gravitybridge-findings/issues/6
- Library page: https://bugbountylibrary.com/r/c4%3A2021-08-gravitybridge%3AH-04
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:rust technique:source-review vuln:dos

**Target:** Rust orchestrator relayer/oracle event search (find_latest_valset, check_for_events)
**Root cause:** find_latest_valset queries a fixed 5000-block range for VALSET_UPDATED events; with large validator sets each log is ~19KB, so enough updates push the response past the 10MB RPC limit, returning an error every loop.
**Steps:**
1. Note BLOCKS_TO_SEARCH = 5000 and check_for_events queries VALSET_UPDATED_EVENT_SIG over that range
2. Compute log size: 4*32 + 64*N bytes; at N=300 validators ~19328 bytes per log
3. Exceed 10MB when updates per 5000 blocks > ~517 (10MB / 19328)
4. Trigger rapid valset updates or large validator set so eth_getLogs returns byte-limit error
5. Observe eth_oracle_main_loop and relayer_main_loop stuck in perpetual errors, halting attestations
**How found:** Reasoned by analogy to the ERC20 large-name freeze finding, then read find_latest_valset's fixed 5000-block check_for_events call and computed per-log byte size (4*32+64*N) against the 10MB limit to derive the 517-updates threshold.
**Exploitation:** A large validator set or rapid validator updates cause the fixed-range event query to exceed the RPC 10MB response cap; the relayer/oracle loops error continuously, halting attestations and freezing the bridge until patched.
**Insight:** Fixed-block-range eth_getLogs queries have an implicit byte cap; compute worst-case log size (4*32+64*N per valset event) against the 10MB RPC limit to find liveness DoS thresholds, and chunk-and-retry on byte-limit errors.