# Can get around hats per level constraints using phantom levels

Hats protocol caps each hat at 65,536 direct children, but admins can bypass the limit by inserting phantom zero-levels into hatIds to mint unlimited children.

- Payout: Contest reward
- Severity: medium
- Program: Hats
- Credited: 0xMojito
- Disclosed: 2023-02-15
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-hats-judging/issues/47
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-hats%3AM-8
- Tags: domain:web3 impact:integrity kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Hats.sol createHat / hatId tree structure
**Root cause:** createHat only checks lastHatId overflow per level and never validates that the admin hatId has no empty (0000) intermediate levels, so a non-existent admin path can be used to reset the child counter.
**Steps:**
1. Top hat 0x1 mints all 65,536 children (0x1.0001..0x1.ffff).
2. Admin sets admin to 0x1.0000.0001 (a hatId with an empty level that cannot exist).
3. createHat under 0x1.0000.0001 succeeds, minting 0x1.0000.0001.0001..0x1.0000.0001.ffff.
4. Repeat at each level to obtain unlimited direct children under 0x1.
**How found:** Reading the overflow-based child-count constraint in createHat and noticing nothing validates that the admin hatId path contains no empty levels, then constructing a hatId with a 0000 segment.
**Escalation:** Repeating phantom levels at each depth yields effectively unlimited direct descendants, violating the per-level constraint and confusing indexers/protocols that assume valid hatIds.
**Insight:** When a limit is enforced via a counter keyed on a structured ID, check whether the ID's structure itself can be forged (empty segments, non-existent parents) to reset or sidestep the counter.