# Truncated nonce and size parameters

Byte-vs-bit units, signed size coercion, and raw packed-word compares that corrupt shared state

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2026-09-01. Updated 2026-10-29._

## How it works
A length, size, or nonce parameter is silently narrowed before it reaches the code that consumes it. The caller believes it asked for full entropy or a valid length; the callee receives a much smaller or negative value. The generator or accounting routine then produces a degenerate result that persists in shared state, so every later operation inherits the corruption. The broken assumption is that the parameter's units and sign survive the API boundary intact.

## Where it shows up
- Byte-length constants passed to functions expecting a bit length (e.g. 32 bytes fed to a bit-count parameter) [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-w3g8-fp6j-wvqw.md)
- Signed 32-bit coercions on size/length: `| 0`, `>>> 0`, `parseInt` truncation [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-xwg4-73v4-xw9w.md)
- Shared CSPRNG pools or buffers whose offset is adjusted by a caller-supplied length [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-xwg4-73v4-xw9w.md)
- Equality or hashing that compares raw packed words when a flag bit or alternate encoding can vary [E3](https://bugbountylibrary.com/r/c4%3A2025-04-forte-float128-solidity-library%3AH-04.md)
- Any nonce/random call whose requested entropy is not visibly tied to the curve order or key size [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-w3g8-fp6j-wvqw.md)

## How to review
Trace each size/nonce argument from caller to consumer and confirm units match (bytes vs bits) and sign is preserved. For generators, verify the entropy actually requested equals the security parameter (e.g. full curve-order bits), not a byte count reused as a bit count [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-w3g8-fp6j-wvqw.md). For shared pools, confirm a negative or oversized length cannot skip the refresh branch or leave a persistent negative offset [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-xwg4-73v4-xw9w.md). For packed numeric types, require that eq/hash normalize away flag bits and alternate mantissa encodings before comparing [E3](https://bugbountylibrary.com/r/c4%3A2025-04-forte-float128-solidity-library%3AH-04.md). The invariant: the value the consumer uses must equal the value the caller intended, in the same units and sign.

## Variants seen
- Unit mismatch: byte constant used as bit length, collapsing nonce entropy to 32 bits [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-w3g8-fp6j-wvqw.md)
- Signed coercion: `size |= 0` wraps negative, corrupting the CSPRNG pool permanently [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-xwg4-73v4-xw9w.md)
- Raw-word equality: packed float with differing mantissa flags compares unequal despite equal value [E3](https://bugbountylibrary.com/r/c4%3A2025-04-forte-float128-solidity-library%3AH-04.md)

## Impact and severity
E1 let an attacker recover the nonce and decrypt any ciphertext from the public key alone. E2 turned all subsequent IDs into a constant string, destroying uniqueness. E3 broke equality logic in a fixed-point math library, corrupting downstream accounting. Severity is high because the corruption is silent and persists in shared state; it worsens when the degenerate output feeds key material or identifiers.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-w3g8-fp6j-wvqw.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-xwg4-73v4-xw9w.md
- E3: https://bugbountylibrary.com/r/c4%3A2025-04-forte-float128-solidity-library%3AH-04.md