# Unchecked index array write

Attacker-controlled index or length reaching an array write or copy without a bound check

_Area: Memory corruption and native code. Seen in 4 disclosed reports; one confirmed bounty: $800; latest 2024-12-20. Updated 2026-11-08._

## How it works

Code takes an index or length from input and uses it to write into, fill, or copy from an array without confirming it fits. The broken assumption is that the caller-supplied number is already valid, or that a nearby check (array size, a delimiter, a length word) also constrains the value that actually drives the write. When it does not, the write lands past the buffer: a panic, a heap overflow, or a copy from unallocated memory.

## Where it shows up

- Host-import or FFI bridges that take a length and index a host-side buffer with it [E1](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-13.md)
- Array splice/fill helpers where a head index feeds a nil-fill loop [E2](https://bugbountylibrary.com/r/h1%3A197719.md)
- Token-scan loops that stop only on a delimiter (whitespace) and not on NUL or end-of-buffer [E3](https://bugbountylibrary.com/r/h1%3A1753224.md)
- Assembly memory-pointer helpers where `.next()`/`.offset()` is applied after skipping a length word [E4](https://bugbountylibrary.com/r/c4%3A2023-01-opensea%3AM-01.md)
- Defaults of zero length or empty arrays that make any positive value immediately out of range [E1](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-13.md)[E4](https://bugbountylibrary.com/r/c4%3A2023-01-opensea%3AM-01.md)

## How to review

For every write, fill, or copy, trace the index/length back to its source. The invariant: before the write, `index + count <= capacity` (or the pointer stays within the allocated region), checked on the exact variable used at the sink. Confirm the check covers the head/index, not just the size [E2](https://bugbountylibrary.com/r/h1%3A197719.md); that scan loops also terminate on NUL/end-of-buffer, not only a delimiter [E3](https://bugbountylibrary.com/r/h1%3A1753224.md); and that pointer arithmetic lands on array data, not past the last element [E4](https://bugbountylibrary.com/r/c4%3A2023-01-opensea%3AM-01.md). Treat any user-controlled length paired with unchecked indexing as a bug even if it only panics [E1](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-13.md).

## How finders spotted it

- Read every host import that takes a length and indexes a buffer; noticed the default length was 0, so any positive value panics [E1](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-13.md)
- Revisited a prior fix and saw it validated array size but left the head value unchecked, then kept size constant while inflating head [E2](https://bugbountylibrary.com/r/h1%3A197719.md)
- Read the token loop and saw it only stops on whitespace; a file ending in non-space chars without a newline runs past the buffer, confirmed with a 4095-byte file [E3](https://bugbountylibrary.com/r/h1%3A1753224.md)
- Traced each `.next()`/`.offset()` against the ABI head/tail layout, cross-checking precompile and compiler docs to see the copy read unallocated memory [E4](https://bugbountylibrary.com/r/c4%3A2023-01-opensea%3AM-01.md)

## Variants seen

- Unchecked length indexing a host buffer in a WASM import, causing a panic/DoS [E1](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-13.md)
- Huge head index into a splice/fill routine, heap overflow [E2](https://bugbountylibrary.com/r/h1%3A197719.md)
- Delimiter-only scan loop walking past a stack buffer, OOB read plus 1-byte zero write [E3](https://bugbountylibrary.com/r/h1%3A1753224.md)
- Pointer advanced past an array, identity precompile copying unallocated memory [E4](https://bugbountylibrary.com/r/c4%3A2023-01-opensea%3AM-01.md)

## Why fixes fail

E2's earlier fix validated array size but not the head value, so a huge head still overflowed [E2](https://bugbountylibrary.com/r/h1%3A197719.md).

## Impact and severity

Ranged from crashing all validators and halting a chain [E1](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-13.md), heap overflow and SIGSEGV [E2](https://bugbountylibrary.com/r/h1%3A197719.md), and a crash from OOB read/write [E3](https://bugbountylibrary.com/r/h1%3A1753224.md), to corrupted order hashes in signed payloads [E4](https://bugbountylibrary.com/r/c4%3A2023-01-opensea%3AM-01.md). Impact rose where the write reached shared infrastructure (all validators) [E1](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-13.md) or corrupted data later trusted by signature checks [E4](https://bugbountylibrary.com/r/c4%3A2023-01-opensea%3AM-01.md).

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-13.md
- E2: https://bugbountylibrary.com/r/h1%3A197719.md
- E3: https://bugbountylibrary.com/r/h1%3A1753224.md
- E4: https://bugbountylibrary.com/r/c4%3A2023-01-opensea%3AM-01.md