# Crash & Poison via simulateTransaction

simulateTransaction unwraps into_legacy_transaction() which returns None for v0/v1 txs, panicking while holding RwLock write-guards and poisoning locks to DoS all RPC calls.

- Payout: Contest reward
- Severity: medium
- Program: Solaxy
- Credited: potato
- Disclosed: 2025-09-01
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_solaxy.pdf#3.2.2
- Library page: https://bugbountylibrary.com/r/cantina%3Asolaxy%3A3.2.2
- Tags: domain:web3 impact:dos kind:contest platform:cantina sev:medium tech:rust technique:source-review vuln:dos vuln:misconfiguration

**Target:** RPC simulateTransaction handler (mod.rs)
**Root cause:** VersionedTransaction::into_legacy_transaction() returns None for v0/v1 message formats, and the code unconditionally unwraps the result, panicking inside a critical section holding RwLock write-guards.
**Steps:**
1. Submit a v0 or v1 VersionedTransaction to the simulateTransaction RPC endpoint
2. into_legacy_transaction() returns None
3. unwrap() panics while working_set/accounts RwLock write-guards are held
4. Panic unwinds through RwLock, poisoning the lock
5. Subsequent RPC calls touching the lock hit unwrap_infallible() and panic, DoSing the node until restart
**How found:** Code review of the simulateTransaction path in mod.rs; noticed into_legacy_transaction() returns None for modern v0/v1 formats and the result was unwrapped unconditionally inside a lock-holding section.
**Exploitation:** A single crafted v0/v1 transaction sent to simulateTransaction triggers the panic; lock poisoning then causes every subsequent RPC call touching the same locks to panic, taking down RPC service until process restart.
**Insight:** When auditing RPC handlers, check unwrap() on conversion functions that only support legacy formats; a panic inside a lock-holding scope poisons the lock and turns a single bad request into a persistent DoS via unwrap_infallible elsewhere.