# Attacker can slow down / halt the chain by queuing multiple stake removals or delegate stake removals

Allora's EndBlocker loops over all queued stake removals per block with no minimum stake, letting an attacker queue many 1 uallo removals to slow or halt the chain.

- Payout: Contest reward
- Severity: high
- Program: Allora
- Credited: imsrybr0
- Disclosed: 2024-06-24
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-06-allora-judging/issues/56
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-06-allora%3AH-8
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:high tech:go technique:source-review vuln:dos

**Target:** Cosmos SDK emissions module EndBlocker stake removal processing
**Root cause:** EndBlocker iterates over every queued stake and delegate-stake removal for the block in a single unbounded loop, and there is no minimum stake amount, so an attacker can enqueue arbitrarily many tiny removals.
**Steps:**
1. Register multiple reputers (paying registration fee) or use multiple addresses.
2. Add `1 uallo` stake to each reputer, or delegate `1 uallo` from many addresses to each reputer.
3. Cancel each stake/delegate stake so removals are queued for the same block.
4. EndBlocker's `RemoveStakes`/`RemoveDelegateStakes` loop over all queued removals, consuming block gas and slowing/halting the chain.
**How found:** Code review of the emissions module EndBlocker: noticed `RemoveStakes`/`RemoveDelegateStakes` iterate over all removals for a block with no cap, and that no minimum stake amount exists to bound the number of entries.
**Exploitation:** Attacker floods the per-block stake-removal queue with many minimal (1 uallo) removals via many reputers or delegator addresses, causing the EndBlocker loop to process an unbounded number of entries and degrade or halt block production.
**Insight:** In Cosmos modules, any per-block EndBlocker loop over a user-populatable queue is a DoS vector; check whether minimum amounts or batch caps bound the iteration count.