# Unbounded caller-supplied duration or period

Caller-controlled duration, gas price, fee, or lock timer skews penalty, reward, refund, or vesting math

_Area: DeFi accounting and math bugs. Seen in 21 disclosed reports; latest 2025-07-22. Updated 2026-10-22._

## How it works
A value the caller (or a semi-trusted role) supplies — a duration, a gas price, a fee cap, a lock timer — is used directly in accounting math without an upper bound or a check against the protocol's own invariant. The assumption that breaks is that the parameter stays within the range the math was designed for. When it does not, penalties, rewards, refunds, or locks drift away from the intended economics, and the party who controls the parameter captures the difference.

## Where it shows up
- Refund or reimbursement computed as `tx.gasprice * gas` where the submitter sets `tx.gasprice` [E3](https://bugbountylibrary.com/r/c4%3A2022-02-skale%3AH-02.md)
- Fee or `maxFee` decoded from a caller-supplied message blob and forwarded with no protocol cap [E5](https://bugbountylibrary.com/r/sherlock%3A2025-07-malda%3AM-12.md)
- A flat penalty percentage paired with a reward weight that scales with a user-chosen lock duration [E7](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AM-15.md)
- A lock/cooldown timer set inside a shared `mint` path that third parties can trigger for a privileged recipient [E4](https://bugbountylibrary.com/r/sherlock%3A2025-07-mellow-flexible-vaults%3AM-8.md)
- Auction or reward elapsed time anchored to request time rather than oracle fulfillment time [E8](https://bugbountylibrary.com/r/sherlock%3A2024-05-pooltogether%3AM-12.md)
- Proportional scaling of stored targets/balances with no bound tied to the documented invariant [E6](https://bugbountylibrary.com/r/sherlock%3A2025-04-burve%3AM-5.md)
- Enumeration over a map that keeps zeroed entries, so a payout loop grows without bound [E2](https://bugbountylibrary.com/r/c4%3A2024-08-phi%3AH-03.md)
- Sender-chosen destination gas compared against worst-case intrinsic gas of attacker data [E1](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AH-07.md)

## How to review
For every caller-supplied number that reaches accounting, find the enforced bound and confirm it matches the math's design range. The invariant to check: the parameter's effect on penalty, reward, refund, or lock must stay within the protocol's documented limit for all admissible inputs. Concretely: is there a cap or oracle on gas price [E3](https://bugbountylibrary.com/r/c4%3A2022-02-skale%3AH-02.md) and fees [E5](https://bugbountylibrary.com/r/sherlock%3A2025-07-malda%3AM-12.md); does a flat penalty stay economically meaningful against max reward weight [E7](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AM-15.md); can a third party reset a privileged lock timer [E4](https://bugbountylibrary.com/r/sherlock%3A2025-07-mellow-flexible-vaults%3AM-8.md); is elapsed time measured from fulfillment, not request [E8](https://bugbountylibrary.com/r/sherlock%3A2024-05-pooltogether%3AM-12.md); does the stored target stay within `deMinimus` bounds after repeated operations [E6](https://bugbountylibrary.com/r/sherlock%3A2025-04-burve%3AM-5.md); are map entries deleted, not zeroed, before enumeration [E2](https://bugbountylibrary.com/r/c4%3A2024-08-phi%3AH-03.md); does minimum gas cover worst-case intrinsic gas [E1](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AH-07.md).

## Variants seen
- Unbounded gas price in refund path [E3](https://bugbountylibrary.com/r/c4%3A2022-02-skale%3AH-02.md)
- Unchecked fee cap in bridge message [E5](https://bugbountylibrary.com/r/sherlock%3A2025-07-malda%3AM-12.md)
- Flat penalty vs duration-scaled reward [E7](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AM-15.md)
- Shared mint resetting a fee recipient's lock [E4](https://bugbountylibrary.com/r/sherlock%3A2025-07-mellow-flexible-vaults%3AM-8.md)
- Async oracle latency inflating auction reward [E8](https://bugbountylibrary.com/r/sherlock%3A2024-05-pooltogether%3AM-12.md)
- Proportional scaling breaking a value-vs-target invariant [E6](https://bugbountylibrary.com/r/sherlock%3A2025-04-burve%3AM-5.md)
- Zeroed-but-retained map entries bloating a payout loop [E2](https://bugbountylibrary.com/r/c4%3A2024-08-phi%3AH-03.md)
- User gas limit below worst-case intrinsic gas [E1](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AH-07.md)

## Impact and severity
Funds drained via inflated refunds [E3](https://bugbountylibrary.com/r/c4%3A2022-02-skale%3AH-02.md) or bridge fees [E5](https://bugbountylibrary.com/r/sherlock%3A2025-07-malda%3AM-12.md); protocol fees permanently frozen [E4](https://bugbountylibrary.com/r/sherlock%3A2025-07-mellow-flexible-vaults%3AM-8.md); rewards overpaid [E8](https://bugbountylibrary.com/r/sherlock%3A2024-05-pooltogether%3AM-12.md); boosted rewards farmed then cheaply exited [E7](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AM-15.md); invariant drift [E6](https://bugbountylibrary.com/r/sherlock%3A2025-04-burve%3AM-5.md); rewards distribution frozen by gas limit [E2](https://bugbountylibrary.com/r/c4%3A2024-08-phi%3AH-03.md); all outbound transactions to a chain halted [E1](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AH-07.md). Severity rises when the parameter is fully caller-controlled and the loss is direct value transfer.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AH-07.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-08-phi%3AH-03.md
- E3: https://bugbountylibrary.com/r/c4%3A2022-02-skale%3AH-02.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2025-07-mellow-flexible-vaults%3AM-8.md
- E5: https://bugbountylibrary.com/r/sherlock%3A2025-07-malda%3AM-12.md
- E6: https://bugbountylibrary.com/r/sherlock%3A2025-04-burve%3AM-5.md
- E7: https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AM-15.md
- E8: https://bugbountylibrary.com/r/sherlock%3A2024-05-pooltogether%3AM-12.md