# Parser length and terminator bugs

Decoders that accept trailing bytes, skip length checks, or misread offsets and return wrong values

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2023-08-31. Updated 2026-10-29._

## How it works
A parser is trusted to consume exactly the bytes it was given and to reject anything else. The assumption that breaks: that the decoder validates the input's boundaries. When a length, terminator, or end-of-stream check is missing, the parser returns a value derived from bytes outside the intended range instead of reverting. The caller then treats that wrong value as authoritative.

## Where it shows up
- RLP/ABI/hex decoders that decode expected fields but never assert the stream is fully consumed [E1](https://bugbountylibrary.com/r/h1%3A396954.md)
- Conversion loops indexing by pairs without checking odd length, `<N`, or `>N` [E2](https://bugbountylibrary.com/r/c4%3A2023-04-ens%3AM-01.md)
- Fallback branches for "terminator not found" that use the whole buffer length instead of the caller's `offset+len` bound [E3](https://bugbountylibrary.com/r/c4%3A2023-04-ens%3AM-04.md)
- Two byte representations of the same object (raw vs. canonical) used for different purposes [E1](https://bugbountylibrary.com/r/h1%3A396954.md)

## How to review
Identify the exact invariant: the parser must consume exactly the declared range and revert otherwise. Check that after decoding all fields the cursor equals the input length [E1](https://bugbountylibrary.com/r/h1%3A396954.md); that length is validated before indexing, including odd and overlong cases [E2](https://bugbountylibrary.com/r/c4%3A2023-04-ens%3AM-01.md); and that every not-found/fallback path clamps to the caller-supplied bound, not `input.length` [E3](https://bugbountylibrary.com/r/c4%3A2023-04-ens%3AM-04.md). Confirm the same canonical bytes are used for hashing/signature and for storage/propagation [E1](https://bugbountylibrary.com/r/h1%3A396954.md). Test boundary inputs explicitly.

## Variants seen
- Missing end-of-data check: trailing RLP bytes accepted and propagated [E1](https://bugbountylibrary.com/r/h1%3A396954.md)
- Missing length validation in hex converters: silent truncation, padding, or out-of-range read [E2](https://bugbountylibrary.com/r/c4%3A2023-04-ens%3AM-01.md)
- Wrong fallback bound: value and next offset extend past the requested slice [E3](https://bugbountylibrary.com/r/c4%3A2023-04-ens%3AM-04.md)

## Impact and severity
E1 let arbitrary data reach the chain without gas payment, a protocol-level integrity and economic issue. E2 and E3 silently corrupt parsed values (addresses, DNS record key-values), which can misroute funds or logic downstream. Severity rises when the wrong value feeds signature checks, accounting, or access decisions rather than being caught by a later revert.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A396954.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-04-ens%3AM-01.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-04-ens%3AM-04.md