#  Attacker can force chaotic operator behavior

Attacker bonds to a high pod tier then unbonds, filling intermediate pods with zero-address entries so the scheduler picks empty pods and triggers 'open season' griefing.

- Payout: Contest reward
- Severity: medium
- Program: Holograph
- Credited: Trust
- Disclosed: 2022-12-15
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-10-holograph-findings/issues/432
- Library page: https://bugbountylibrary.com/r/c4%3A2022-10-holograph%3AM-07
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** HolographOperator.sol pod scheduling / bondUtilityToken
**Root cause:** bondUtilityToken pushes zero-address placeholder pods for every intermediate tier up to the selected pod, and these empty pods remain after unbonding, so the uniform scheduler frequently selects a zero-address operator.
**Steps:**
1. Call `bondUtilityToken(attacker, large_amount, high_pod_number)` to push zero-address pods for all intermediate tiers
2. Call `unbondUtilityToken(attacker, attacker)` to recover funds, leaving empty pods in place
3. Optionally wrap in a flash loan to reach arbitrarily high pod tiers
4. Scheduler uniformly selects pods; empty pods yield operator address(0), triggering 'open season' where any operator can call executeJob()
**How found:** Code review of bondUtilityToken's pod-filling loop and the scheduler's uniform pod selection, noticing zero-address placeholders persist after unbond and are treated as 'open season'.
**Exploitation:** Attacker repeatedly bonds to high pod tiers and unbonds, permanently inflating the pod array with zero-address entries. When jobs are scheduled to these empty pods, operator resolves to address(0) and any operator may execute, causing gas-wasting races and reverted transactions for all but the first executor.
**Insight:** Placeholder/zero-address sentinel entries inserted to handle empty collections can be weaponized when selection is uniform: check whether an attacker can inflate the collection with sentinels cheaply and whether those sentinels map to a privileged fallback path.