# Unbounded loop denial of service

Collections grown by others and iterated in full per call, with no cap or pagination

_Area: Smart contract access control and control flow. Seen in 94 disclosed reports; one confirmed bounty: $4,000; latest 2026-08-20. Updated 2026-10-23._

## How it works
A function iterates a collection whose size is set by parties other than the caller. Appending is cheap and open; the full walk is paid by whoever triggers the function. Past the point where the walk fits in one transaction's gas (or a runtime budget), the function reverts for everyone, and the state it guards becomes unreachable. The broken assumption is that the collection stays small enough to iterate; nothing enforces it. The same holds for memory: entries keyed by peer-controlled IDs that are only removed when the peer cooperates [E1](https://bugbountylibrary.com/r/h1%3A363636.md), or guest output copied into host memory with no size limit [E3](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-5.md).

## Where it shows up
- Per-user arrays appended on every action and iterated in full on every call [E2](https://bugbountylibrary.com/r/sherlock%3A2025-05-layeredge%3AM-1.md).
- Arrays appended on every state transition, including no-op same-block transitions [E5](https://bugbountylibrary.com/r/c4%3A2023-10-canto%3AH-01.md).
- Fixed-size storage (PDA) filled by cheap deposits, with no realloc or cleanup on withdrawal [E4](https://bugbountylibrary.com/r/c4%3A2023-12-autonolas%3AH-01.md).
- Maps keyed by peer-supplied IDs, removed only on peer response, no TTL [E1](https://bugbountylibrary.com/r/h1%3A363636.md).
- One output channel bounded, a sibling channel (stdout/stderr) not [E3](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-5.md).
- A documented reserve/loop cap with entrypoints that write the bitmap without checking it [E6](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-12.md).
- Batch rotation that appends to an already-full batch under the same key [E7](https://bugbountylibrary.com/r/c4%3A2025-02-recall%3AH-04.md).
- Size caps whose removal path does not decrement the counted unit [E8](https://bugbountylibrary.com/r/c4%3A2025-07-gte-spot-clob-and-router%3AM-03.md).

## How to review
For each loop, name what grows the collection, who can grow it, and whether the grower is the party harmed. Invariant: maximum iterations must be bounded by a constant or by caller-supplied pagination, independent of other users' actions. Confirm caps are enforced on every write path, not just documented [E6](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-12.md); that removal actually decrements the counted unit [E8](https://bugbountylibrary.com/r/c4%3A2025-07-gte-spot-clob-and-router%3AM-03.md); that rotation keys cannot collide [E7](https://bugbountylibrary.com/r/c4%3A2025-02-recall%3AH-04.md); that every guest-controlled buffer crossing FFI is bounded [E3](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-5.md). To confirm exploitability, estimate gas (or memory) for a full walk at realistic growth versus the block/runtime limit, and check who pays and whether the victim can shrink the list.

## Variants seen
- Griefing by inflating a victim's history array [E2](https://bugbountylibrary.com/r/sherlock%3A2025-05-layeredge%3AM-1.md).
- Cheap dust deposits exhausting fixed PDA storage [E4](https://bugbountylibrary.com/r/c4%3A2023-12-autonolas%3AH-01.md).
- Spam swaps growing a tick array [E5](https://bugbountylibrary.com/r/c4%3A2023-10-canto%3AH-01.md).
- Phantom collateral bits bypassing a reserve cap [E6](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-12.md).
- Batch overflow making checkpoints unexecutable [E7](https://bugbountylibrary.com/r/c4%3A2025-02-recall%3AH-04.md).
- Partial removal silently disabling a size cap [E8](https://bugbountylibrary.com/r/c4%3A2025-07-gte-spot-clob-and-router%3AM-03.md).
- Peer-keyed map never purged [E1](https://bugbountylibrary.com/r/h1%3A363636.md); unbounded guest output [E3](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-5.md).

## Impact and severity
Funds locked permanently [E2](https://bugbountylibrary.com/r/sherlock%3A2025-05-layeredge%3AM-1.md)[E4](https://bugbountylibrary.com/r/c4%3A2023-12-autonolas%3AH-01.md), mint/burn bricked [E5](https://bugbountylibrary.com/r/c4%3A2023-10-canto%3AH-01.md), positions unliquidatable [E6](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-12.md), checkpoints halted [E7](https://bugbountylibrary.com/r/c4%3A2025-02-recall%3AH-04.md), node OOM crash [E1](https://bugbountylibrary.com/r/h1%3A363636.md)[E3](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-5.md). Severity rises when griefing is cheap, the victim cannot shrink the list, and no admin recovery exists. Mitigations: pagination, pull-over-push, per-user caps, TTLs, realloc/cleanup.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A363636.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2025-05-layeredge%3AM-1.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-5.md
- E4: https://bugbountylibrary.com/r/c4%3A2023-12-autonolas%3AH-01.md
- E5: https://bugbountylibrary.com/r/c4%3A2023-10-canto%3AH-01.md
- E6: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-12.md
- E7: https://bugbountylibrary.com/r/c4%3A2025-02-recall%3AH-04.md
- E8: https://bugbountylibrary.com/r/c4%3A2025-07-gte-spot-clob-and-router%3AM-03.md