# Unauthenticated DoS via JsTracer on debug_traceBlockByNumber Endpoint

Public debug_traceBlockByNumber on Citrea full nodes executes attacker-supplied JsTracer JavaScript in Boa without memory limits, letting one request exhaust gigabytes of RAM and crash the node.

- Payout: Contest reward
- Severity: medium
- Program: Citrea
- Credited: franfran
- Disclosed: 2025-10-21
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_citrea_jul2025.pdf#3.2.8
- Library page: https://bugbountylibrary.com/r/cantina%3Acitrea_jul2025%3A3.2.8
- Tags: domain:web3 impact:dos kind:contest platform:cantina sev:medium tech:evm technique:source-review vuln:dos vuln:misconfiguration

**Target:** JSON-RPC debug_traceBlockByNumber endpoint (JsTracer via Boa engine)
**Root cause:** The debug_traceBlockByNumber RPC accepts a JsTracer(code) tracer and runs it server-side in the Boa JS engine, which enforces loop/recursion limits but no memory limit. The endpoint is exposed unauthenticated on full nodes.
**Steps:**
1. Start sequencer and full node with mock DA layer (`citrea --dev --da-layer mock ...`).
2. Deploy a contract and send a tx (`cast send ... "setNumber(uint256)" 123456789`) to get a block number, e.g. `0x23`.
3. POST to the node: `{"jsonrpc":"2.0","method":"debug_traceBlockByNumber","params":["0x23",{"tracer":"{step: function(log){ let arr=[]; for(let i=0;i<2000000;i++){ arr.push(new Array(100000).fill(\"x\".repeat(10000))); } }, result:function(){return{}}, fault:function(){}}"}]}`
4. Fire many concurrent requests in a bash loop to amplify memory pressure.
5. Observe node stops logging, memory spikes in btop, and RPC calls time out (`cast block-number` errors).
**How found:** Noticed the debug_traceBlockByNumber endpoint accepts a JsTracer code field executed server-side; reasoned that Boa has iteration/recursion caps but no memory cap, then tested a memory-heavy step function against a local node.
**Exploitation:** Unauthenticated attacker sends a single HTTP POST with a JsTracer step function that allocates huge arrays per EVM opcode; Boa's loop limit (200k) still permits gigabytes of allocation, halting the node. Parallel requests overwhelm the host entirely.
**Escalation:** Mass parallel curl requests to exhaust all node resources and take down RPC availability.
**Insight:** When a node exposes Geth-style JS tracers, the JS engine's loop/recursion limits are not memory limits — a single step callback allocating large arrays per opcode bypasses iteration caps and is a cheap unauthenticated DoS.