# Since art pieces' size is not limited, attacker may block AuctionHouse from creating and settling auctions

Unbounded ArtPieceMetadata string length lets a winning art piece bloat gas in AuctionHouse settle/create, potentially DoSing auctions.

- Payout: Contest reward
- Severity: medium
- Program: Collective
- Credited: bart1e
- Disclosed: 2024-02-08
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-12-revolutionprotocol-findings/issues/178
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-revolutionprotocol%3AM-11
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:dos

**Target:** AuctionHouse / CultureIndex art metadata storage
**Root cause:** CultureIndex::createPiece only checks media type non-zero, not field length; oversized metadata is stored and later fetched repeatedly in _settleAuction/_createAuction, inflating gas.
**Steps:**
1. Call createArtPieceMultiCreator with MediaType.IMAGE and a ~1.3MB string of `\x00` in the unused metadata text field
2. Let the piece win voting (or buy votes early to self-win)
3. Call `auction.settleCurrentAndCreateNewAuction()` and observe gas consumption (~22M for settle, block-limit for create)
4. Repeat with ~900KB string to push _createAuction to block gas limit
**How found:** Code review of createPiece validation (only validateMediaType non-zero) combined with noticing getArtPieceById is called in loops in _settleAuction/_createAuction, then measuring gas with a crafted oversized metadata string.
**Exploitation:** Attacker submits a visually normal artwork hiding a huge zero-byte string in an irrelevant metadata field; once it wins voting, every auction settle/create that fetches the piece burns excessive gas, blocking new auctions until another piece wins.
**Escalation:** Attacker can also specify multiple malicious creators to add ~20M more gas to _settleAuction, or buy NontransferableERC20Votes early to self-win before quorum grows.
**Insight:** When storage writes are cheap but reads happen in loops during settlement, unbounded user-controlled string fields become gas-DoS vectors; zero-byte strings exploit sreset pricing to minimize attacker cost.