# Permanent DOS in liquidity_lockbox for under $10

liquidity_lockbox PDA storage fills after ~625 deposits, permanently blocking all future deposits for under $10.

- Payout: Contest reward
- Severity: high
- Program: Olas
- Credited: EV\_om
- Disclosed: 2024-02-06
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-12-autonolas-findings/issues/445
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-autonolas%3AH-01
- Tags: domain:oss domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:dos

**Target:** Solana Solidity (Solang) liquidity_lockbox contract, PDA data account
**Root cause:** Each deposit() appends entries to positionAccounts, mapPositionAccountPdaAta, and mapPositionAccountLiquidity (128 bytes total) in a PDA capped at 10 KiB, with no realloc or cleanup on withdrawal.
**Steps:**
1. Call `deposit()` with the minimum position size (dust) repeatedly.
2. Each call consumes 64+32+32=128 bytes of PDA storage.
3. After ~625 deposits (80000/128) the 10 KiB PDA is full.
4. All subsequent `deposit()` calls revert, permanently bricking deposits.
**How found:** Code reading of deposit() storage writes combined with knowledge of Solana PDA 10 KiB creation limit and Solang's lack of realloc support.
**Exploitation:** Attacker repeatedly calls deposit() with dust-sized positions (~625 times) at cost of dust plus tx fees under $10, filling the PDA storage so no legitimate deposits can ever succeed.
**Insight:** On Solana/Solang contracts, check whether per-user state appended on each call lives in a fixed-size PDA; if no realloc or withdrawal cleanup exists, dust deposits can exhaust it cheaply.