# [Xenoblade Chronicles X: Definitive Edition] Unrestricted RPCs allow DoS and writing arbitrary flags remotely

Unchecked array indices in Xenoblade Chronicles X RPCs let a modified-console peer write arbitrary memory and save flags to other players, causing DoS and save corruption.

- Payout: hidden
- Severity: critical
- Program: Nintendo
- Found by: roccodev
- Disclosed: 2025-05-15
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/3062122
- Library page: https://bugbountylibrary.com/r/h1%3A3062122
- Tags: area:devices domain:network impact:dos impact:integrity kind:bounty platform:hackerone sev:critical technique:reverse-engineering vuln:access-control vuln:dos vuln:memory-corruption

**Target:** Nintendo Switch game peer-to-peer RPC protocol
**Root cause:** RPC handlers use attacker-supplied inputs as array indices without bounds checks, and one RPC writes arbitrary save flags without restricting to multiplayer-exposed ranges.
**Steps:**
1. Join the same peer-to-peer online mission as the victim.
2. Send crafted RPC commands with out-of-range index values to trigger out-of-bounds memory writes.
3. Invoke the unrestricted flag-writing RPC with arbitrary flag IDs to modify the victim's save file.
4. Observe DoS or silent save corruption on the victim's console.
**Exploitation:** A malicious user on a modified console joins a shared P2P mission and sends crafted RPCs to peers: out-of-bounds indices cause remote memory corruption/DoS, and the flag RPC silently rewrites victim save flags (e.g. resetting story progress), risking loss of backup saves.
**Insight:** In peer-to-peer game protocols, audit every RPC parameter that later indexes arrays or writes persistent state; unused or debug RPCs often skip the range restrictions applied to normal multiplayer features.