# Index out of bounds error when properties length is more than attributes length breaks minting

MetadataRenderer.addProperties allows more than 15 properties, so onMinted writes past the 16-slot tokenAttributes array and reverts, permanently blocking all token minting.

- Payout: Contest reward
- Severity: medium
- Program: Nouns Builder
- Credited: dipp
- Disclosed: 2022-11-03
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-09-nouns-builder-findings/issues/523
- Library page: https://bugbountylibrary.com/r/c4%3A2022-09-nouns-builder%3AM-09
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** MetadataRenderer.sol onMinted / addProperties (ERC-721 metadata renderer)
**Root cause:** tokenAttributes is a fixed 16-element array where index 0 holds the property count, but addProperties imposes no cap on the number of properties; onMinted loops over numProperties writing tokenAttributes[i+1], so >15 properties overflows the array.
**Steps:**
1. Deploy DAO via deployWithCustomFounders.
2. Owner calls `metadataRenderer.addProperties(names, items, group)` with 16 names/items, each item isNewProperty=true.
3. Auction calls `token.mint()`, which invokes `onMinted`.
4. onMinted loops i=0..15 writing `tokenAttributes[i+1]`, index 16 out of bounds -> revert `indexOOBError`.
5. All subsequent mints revert; no removal function exists for properties.
**How found:** Code reading of onMinted's fixed-size tokenAttributes array versus the uncapped properties array populated by addProperties; confirmed with a Foundry test asserting the index-out-of-bounds revert.
**Exploitation:** Not attacker-driven; requires the DAO/admin to configure 16+ properties, after which every mint reverts and the auction is permanently bricked with no recovery path.
**Insight:** When a struct packs a count into a fixed-size array (index 0 = length), check that every writer enforces the same bound as the array size; admin-configurable arrays without caps are a classic permanent-DoS vector.