# Malicious user can use an excessively large _toAddress in OFTCore#sendFrom to break layerZero communication

Unbounded _toAddress in OFTCore.sendFrom lets an attacker send an oversized payload that can never execute on the destination chain, permanently blocking the LayerZero channel.

- Payout: Contest reward
- Severity: high
- Program: Uxd
- Credited: 0x52
- Disclosed: 2022-12-27
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-01-uxd-judging/issues/270
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-uxd%3AH-2
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:evm technique:chained technique:source-review vuln:business-logic vuln:dos

**Target:** OFTCore#sendFrom cross-chain messaging (LayerZero OFT)
**Root cause:** _toAddress is arbitrary-length calldata packed into the LayerZero payload with no length cap, so a payload can exceed the destination chain's block gas limit and can never be executed.
**Steps:**
1. Call `OFTCore.sendFrom(_from, dstChainId, _toAddress, _amount, ...)` on the high-gas-limit chain (e.g. Arbitrum) with `_toAddress` set to a massive bytes blob.
2. Payload containing the oversized _toAddress is sent and the outbound nonce increments on the source endpoint.
3. On the destination (e.g. Optimism, 20M gas limit) `receivePayload` requires `_nonce == ++inboundNonce`, but executing the payload runs out of gas, so the nonce can never advance.
4. All subsequent messages on that channel revert at the nonce check, permanently blocking Arbitrum->Optimism communication.
**How found:** Code review of OFTCore.sendFrom noting _toAddress is unbounded bytes calldata; reasoned about LayerZero's default blocking/sequential-nonce behavior and how a payload too large to execute on a lower-gas-limit destination would stall the nonce despite the non-blocking receiver.
**Exploitation:** Attacker pays native fee to send one message with an enormous _toAddress from a high-gas-limit chain to a low-gas-limit chain; the message can never be delivered, so the sequential nonce stalls and the channel is bricked while users can still burn tokens sending into it.
**Escalation:** Repeatable between any pair of chains where source block gas limit exceeds destination, crippling all cross-chain transfers and locking user funds.
**Insight:** When a messaging layer enforces sequential nonces, any input that makes a single message unexecutable on the destination (not just reverting) permanently blocks the channel; audit unbounded calldata that gets packed into cross-chain payloads against the destination chain's gas limit.