# Crafted smart contract can take 1.5 minutes to execute due to inefficient CODESIZE implementation

RSKJ's CODESIZE opcode copies the entire contract bytecode array each call, letting crafted contracts burn ~1.5 min of CPU per execution and stall nodes.

- Payout: hidden
- Severity: medium
- Program: Rootstock Labs
- Found by: guido
- Disclosed: 2025-06-12
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/2489843
- Library page: https://bugbountylibrary.com/r/h1%3A2489843
- Tags: area:web3 domain:web3 impact:dos kind:bounty platform:hackerone sev:medium tech:evm tech:java technique:fuzzing technique:source-review vuln:dos

**Target:** rskj EVM VM.doCODESIZE / Program.getCode
**Root cause:** VM.doCODESIZE() calls program.getCode(), which returns a full copy of the bytecode array via Arrays.copyOf, instead of just the length, so each CODESIZE invocation copies the whole code.
**Steps:**
1. Build rskj at commit a61e9080 with test jar
2. Craft bytecode that repeatedly executes CODESIZE (0x38) and POP (0x50) in a loop, with a large code section
3. Instantiate Program with the crafted code and 6.8M gas, then loop vm.step(program)
4. Observe execution takes ~1m29s due to aggregate terabyte-scale array copies
5. Apply patch adding Program.getCodeLength() returning ops.length and use it in doCODESIZE; runtime drops to 0.755s
**How found:** Code review of VM.doCODESIZE revealed getCode() returns a copied array; researcher hypothesized repeated CODESIZE calls amplify copying cost and used a genetic algorithm to construct a worst-case bytecode reproducer.
**Exploitation:** Deploy a contract whose bytecode densely packs CODESIZE/POP sequences; each block execution copies the full code array repeatedly, consuming node CPU for over a minute per transaction and potentially stalling the network.
**Insight:** When auditing EVM implementations, check opcode handlers that call getters returning defensive copies (Arrays.copyOf) inside hot loops; CODESIZE/EXTCODESIZE and similar metadata opcodes should read length fields directly, and genetic/fuzz search can maximize amplification.