# Unbounded serialization and channel DoS

Size caps applied after serialization, or unwrapped sends on bounded channels, letting one input wedge or crash a node

_Area: Smart contract access control and control flow. Seen in 5 disclosed reports; latest 2026-09-10. Updated 2026-10-23._

## How it works
A component accepts attacker-influenced data whose size or volume is not bounded before it is serialized, parsed, or pushed through a fixed-capacity channel. The limit that should protect the system is either applied too late (after the full payload is built in memory) or not at all, and the failure path is a panic or a permanent error rather than graceful backpressure. The broken assumption is that inputs are small enough or that the transport cap will catch oversized data; in practice one cheap action can exceed the cap every time, so the loop never recovers.

## Where it shows up
- Event watchers or indexers fetching logs over a fixed block range against an RPC with a hard response-size cap [E1](https://bugbountylibrary.com/r/c4%3A2021-08-gravitybridge%3AH-03.md)[E4](https://bugbountylibrary.com/r/c4%3A2021-08-gravitybridge%3AH-04.md).
- On-chain fields (names, symbols, denoms, validator sets) accepted without length or encoding validation and emitted in events [E1](https://bugbountylibrary.com/r/c4%3A2021-08-gravitybridge%3AH-03.md)[E3](https://bugbountylibrary.com/r/c4%3A2021-08-gravitybridge%3AH-02.md)[E4](https://bugbountylibrary.com/r/c4%3A2021-08-gravitybridge%3AH-04.md).
- `.expect()`/`.unwrap()` on `try_send()` to a bounded channel [E2](https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AM-02.md).
- Size checks placed after full serialization, or batch handlers aggregating all items before checking length [E5](https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AM-03.md).
- Parsers that early-return on a bad field before advancing a cursor or last-checked block [E3](https://bugbountylibrary.com/r/c4%3A2021-08-gravitybridge%3AH-02.md).

## How to review
Identify every attacker-reachable input and trace it to the point where a size, count, or capacity limit is enforced. The invariant: the limit must be checked before allocation/serialization, and overflow must produce backpressure or a skipped item, never a panic or a stuck cursor. For watchers, confirm a single unparseable or oversized event cannot prevent the cursor from advancing. For channels, confirm sends handle `Full` without unwrapping. For RPC, confirm caps apply pre-serialization and batches are bounded.

## Variants seen
- Oversized event payload exceeds RPC response cap, wedging the oracle loop [E1](https://bugbountylibrary.com/r/c4%3A2021-08-gravitybridge%3AH-03.md).
- Non-UTF8 field makes the parser error and early-return before updating the cursor [E3](https://bugbountylibrary.com/r/c4%3A2021-08-gravitybridge%3AH-02.md).
- Large/rapid validator-set updates push fixed-range log queries past the byte cap [E4](https://bugbountylibrary.com/r/c4%3A2021-08-gravitybridge%3AH-04.md).
- Bounded channel saturation panics the executor on unauthenticated flood [E2](https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AM-02.md).
- Post-serialization size check and in-memory batch aggregation cause OOM [E5](https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AM-03.md).

## Impact and severity
High: permanent bridge/oracle freeze [E1](https://bugbountylibrary.com/r/c4%3A2021-08-gravitybridge%3AH-03.md)[E3](https://bugbountylibrary.com/r/c4%3A2021-08-gravitybridge%3AH-02.md)[E4](https://bugbountylibrary.com/r/c4%3A2021-08-gravitybridge%3AH-04.md), node crash and realistic chain halt [E2](https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AM-02.md), remote OOM [E5](https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AM-03.md). Worse when the trigger is cheap, unauthenticated, and persistent, and when recovery requires manual intervention.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2021-08-gravitybridge%3AH-03.md
- E2: https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AM-02.md
- E3: https://bugbountylibrary.com/r/c4%3A2021-08-gravitybridge%3AH-02.md
- E4: https://bugbountylibrary.com/r/c4%3A2021-08-gravitybridge%3AH-04.md
- E5: https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AM-03.md