# Bounded check misses entries past limit

Compare setter storage bounds against membership/validation check bounds; tail entries beyond a cap are silently ignored

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2026-08-20. Updated 2026-10-23._

## How it works
A check that decides membership or validity stops looking after a fixed number of entries (a slot count, a reserve constant, a regex match). Anything stored or supplied beyond that point is never examined, so the check returns "not present" or "valid" for entries the operator believed were covered. The root cause is a mismatch between how much data the write path accepts and how much the read path inspects.

## Where it shows up
- Setters store an unbounded list (e.g. `Vec<Address>`) while membership helpers iterate `list.len().min(CONST)` [E2](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-17.md).
- A protocol constant (reserve count, max slots) reused as an iteration bound for admin-configured lists [E2](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-17.md).
- Adjacent: allowlist enforced by regex without anchors/terminators, so suffixes or newlines still match [E3](https://bugbountylibrary.com/r/h1%3A2585855.md).
- Adjacent: identifier resolution that validates as an address before consulting a registry, so a name that is also an address skips the lookup [E1](https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-3.md).

## How to review
The invariant: every entry the write path can store must be reachable by the read/check path. For each membership or validation helper, find the bound it uses and compare it to the setter's bound; they must be equal or the setter must reject overflow. For allowlists, require exact comparison or anchored patterns. For identifier resolution, confirm the registry is consulted before any format-based shortcut.

## Variants seen
- Core: ACL iteration capped by `MAX_RESERVES`, tail entries ignored [E2](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-17.md).
- Adjacent: regex allowlist missing terminator, origin spoofing [E3](https://bugbountylibrary.com/r/h1%3A2585855.md).
- Adjacent: address-vs-username ambiguity bypassing registry lookup [E1](https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-3.md).

## Impact and severity
Blacklisted accounts kept using reserve and liquidation flows [E2](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-17.md); a spoofed origin reached restricted APIs including key export [E3](https://bugbountylibrary.com/r/h1%3A2585855.md); valid paths failed or funds misdirected [E1](https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-3.md). Severity rises when the ignored entries are security controls (blacklists, allowlists) or when no corrective path exists.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-3.md
- E2: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-17.md
- E3: https://bugbountylibrary.com/r/h1%3A2585855.md