# Unbounded swap path parameter vulnerability enabling node Denial of Service attacks

Unbounded swap path length in Super Sushi Samurai DEX forces nodes into O(N) DB queries per swap, enabling cheap blockchain DoS.

- Payout: Contest reward
- Severity: high
- Program: Super Sushi Samurai
- Credited: metaldragon
- Disclosed: 2025-05-15
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_super_sushi_samurai_march2025.pdf#3.1.2
- Library page: https://bugbountylibrary.com/r/cantina%3Asuper_sushi_samurai_march2025%3A3.1.2
- Tags: domain:web3 impact:dos kind:contest platform:cantina sev:high tech:rest technique:source-review vuln:dos

**Target:** DEX swap operations (swap_exact_tokens_for_tokens / swap_tokens_for_exact_tokens) on Chromia Rell
**Root cause:** Swap path parameter has no length limit or cycle/repeat validation, so each token symbol triggers a separate DB SELECT and each pair triggers reserve queries plus INSERTs, with no gas to bound computation.
**Steps:**
1. Call `swap_exact_tokens_for_tokens` with a path list containing thousands of repeating token symbols.
2. `from_assets_symbol_to_assets` issues one SELECT per symbol.
3. `get_amounts_out` issues (N-1) pair reserve queries.
4. `_swap` repeats pair lookups and issues (N-1) INSERTs into uniswap_history_transaction.
5. Node performs unbounded DB work for a single standard-cost swap.
**How found:** Code review of operation.rell swap functions: noticed path is user-controlled and each symbol/pair maps to a discrete DB query, then reasoned that absence of gas plus no path length cap allows amplification.
**Exploitation:** Attacker with minimal token holdings submits swaps with abnormally long, repetitive paths; each costs only a normal swap fee but forces the node through O(N) SELECT/INSERT operations, paralysing node resources and degrading blockchain availability.
**Insight:** On chains without gas metering, any user-supplied list that maps 1:1 to DB queries (token paths, recipient lists, ID arrays) is a DoS amplifier; check for length caps and cycle validation.