# JSON-RPC FilterCriteria.Addresses are unbound and can be used to DoS the RPC

Initia's eth_getLogs JSON-RPC lacked an upper bound on FilterCriteria.Addresses, letting ~200k addresses per request stall the RPC server for 5+ seconds and enable cheap DoS.

- Payout: Contest reward
- Severity: high
- Program: Initia
- Credited: berndartmueller
- Disclosed: 2025-04-10
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2025-02-initia-cosmos#h-04
- Library page: https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-04
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:rest technique:source-review vuln:dos vuln:misconfiguration

**Target:** JSON-RPC eth_getLogs / FilterAPI (minievm)
**Root cause:** GetLogs (and NewFilter/Logs) enforce maxTopics=4 but never cap the length of crit.Addresses, so each address is iterated during log filtering.
**Steps:**
1. Note eth_getLogs accepts FilterCriteria with Addresses array; only Topics is bounded by maxTopics.
2. Compute payload budget: each address ~45 bytes JSON, so ~10MB body fits ~200k addresses.
3. Send `eth_getLogs` with `{"address":[<200k addresses>],"fromBlock":"0x..."}`.
4. Observe request processing exceeds 5 seconds; repeat concurrently to saturate RPC.
5. PoC: patch api_test.go to build 200_000 addresses, call filterAPI.GetLogs, assert elapsed >= 5000ms.
**How found:** Code review of GetLogs noticed Topics was capped at maxTopics while Addresses had no equivalent bound; then estimated JSON payload capacity under the 10MB max-recv-msg-size and benchmarked 200k addresses.
**Exploitation:** Attacker sends repeated ~10MB eth_getLogs requests each carrying ~200k addresses; each request occupies the RPC handler for 5+ seconds, and a small botnet can overload every JSON-RPC server simultaneously at near-zero cost.
**Escalation:** Parallelizing requests across many nodes/botnet to halt all RPC endpoints at once.
**Insight:** When a filter/query API bounds one list field (topics) but not a sibling list field (addresses), check every unbounded array against the transport body-size limit and benchmark worst-case iteration cost.