# Unbounded length causes memory exhaustion

Untrusted length or count used directly to allocate, map, copy, or loop without a cap

_Area: Memory corruption and native code. Seen in 4 disclosed reports; one confirmed bounty: $2,400; latest 2026-05-13. Updated 2026-10-23._

## How it works
A length, count, or size value comes from untrusted input and is used directly to allocate, map, copy, or iterate, with no upper bound and no cost that scales with the bytes consumed. The assumption that breaks is "the input's size is bounded by something the attacker cannot control" — protocol limits, gas price, or the size of the register region. When that assumption is false, a small request forces a large allocation or long loop, and the process runs out of memory or CPU.

## Where it shows up
- Host imports or FFI helpers that take a length and pass it to slice/read/alloc without a max check [E2](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-16.md).
- `mmap`/`remap_pfn_range` where length comes from the VMA size, not the device region size [E1](https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-05-pixel-10-exploit-html.md).
- Decompression or decoding chains whose number of links is unbounded [E4](https://bugbountylibrary.com/r/h1%3A1614330.md).
- Opcode or API handlers that copy a whole buffer when only a length is needed [E3](https://bugbountylibrary.com/r/h1%3A2489843.md).
- `C.CString`/`malloc` in per-request or per-block paths with no matching free [E5](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-3.md).
- Error/abort paths that free a container but not its elements [E6](https://bugbountylibrary.com/r/h1%3A2442613.md).

## How to review
For every untrusted length, trace it to the allocation or loop and ask: what caps it, and does the price charged scale with the bytes? The invariant: worst-case bytes allocated or work done must be bounded by a constant or by a cost the attacker pays proportionally. Check that mmap lengths are clamped to the region size [E1](https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-05-pixel-10-exploit-html.md), that gas/price covers worst-case allocation [E2](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-16.md), that encoding-chain depth has a hard limit [E4](https://bugbountylibrary.com/r/h1%3A1614330.md), and that every allocation has a free on all paths including errors [E5](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-3.md)[E6](https://bugbountylibrary.com/r/h1%3A2442613.md).

## Variants seen
- Unbounded mmap past MMIO region maps adjacent physical memory [E1](https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-05-pixel-10-exploit-html.md).
- Unchecked length in WASM host import inflates memory to OOM [E2](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-16.md).
- Full-buffer copy in a hot opcode burns CPU per call [E3](https://bugbountylibrary.com/r/h1%3A2489843.md).
- Unbounded stacked encodings cause malloc bomb [E4](https://bugbountylibrary.com/r/h1%3A1614330.md).
- Missing free in per-block path leaks until crash [E5](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-3.md).
- Partial free on abort path leaks header strings [E6](https://bugbountylibrary.com/r/h1%3A2442613.md).

## Why fixes fail
E6 shows the abort path freeing the array but not its elements, and the error returns silently, so the leak is invisible without valgrind on a crafted response. E5 shows one allocation freed while a sibling in the same function is not.

## Impact and severity
Node/validator crashes and denial of service [E2](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-16.md)[E4](https://bugbountylibrary.com/r/h1%3A1614330.md)[E5](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-3.md), kernel compromise from userspace via oversized mmap [E1](https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-05-pixel-10-exploit-html.md), and node stalls from CPU burn [E3](https://bugbountylibrary.com/r/h1%3A2489843.md). Severity rises when the path is reachable by any peer or client and the cost to the attacker is near zero.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-05-pixel-10-exploit-html.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-16.md
- E3: https://bugbountylibrary.com/r/h1%3A2489843.md
- E4: https://bugbountylibrary.com/r/h1%3A1614330.md
- E5: https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-3.md
- E6: https://bugbountylibrary.com/r/h1%3A2442613.md