# Bounded channel panic in TokioTaskUpdater causes node crash leading to realistic chain halt

Unauthenticated peer floods Monad validator's bounded 1024-slot TokioTaskUpdater channel with ForwardedTx batches, triggering .expect() panic and node crash.

- Payout: Contest reward
- Severity: medium
- Program: Monad
- Credited: dontonka
- Disclosed: 2026-02-26
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-09-monad#m-02
- Library page: https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AM-02
- Tags: domain:network impact:dos kind:contest platform:code4rena sev:medium tech:rust technique:source-review vuln:dos

**Target:** P2P node port / TokioTaskUpdater executor channel
**Root cause:** exec() calls try_send() on a bounded 1024-slot channel and unwraps with .expect("executor is lagging") instead of applying backpressure or handling overflow, so channel saturation panics the executor.
**Steps:**
1. Connect to a Monad node's peer port (open by design for P2P).
2. Send ForwardedTx messages sized so batches_per_conn × num_connections > 1024, e.g. `500 batches × 5 connections = 2500 batches`.
3. Channel fills; try_send returns Err(Full) and .expect() panics the executor thread.
4. Repeat against each discoverable validator to halt the epoch's validator set.
**How found:** Code review of bft/monad-updaters/src/lib.rs identified a bounded channel (1024 slots) combined with .expect() on try_send(), then reasoned that attacker-controlled ForwardedTx volume could exceed capacity.
**Exploitation:** Unauthenticated attacker opens multiple peer connections and floods ForwardedTx batches exceeding channel capacity, panicking the executor and crashing the node; repeating across all validators in the current epoch yields a chain halt at negligible cost.
**Escalation:** Scale from single-node crash to chain halt by targeting every validator in the current epoch.
**Insight:** When auditing P2P/executor plumbing, grep for .expect()/.unwrap() on try_send()/bounded-channel sends; capacity limits multiplied by attacker-controlled connection count give a cheap unauthenticated DoS.