# Unbounded caller-supplied parameters

User-set rate, proportion, or cap used in fund movement or gating without bounds

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2023-09-07. Updated 2026-10-23._

## How it works
A function accepts a numeric parameter from the caller (rate, proportion, cap, threshold) and uses it directly to move funds, reduce debt, or gate a check, without validating it against a sane range. The assumption that breaks is that the caller supplies a reasonable value. When the value is extreme or zero, the arithmetic or comparison degenerates: a multiplier above 100% distributes more than was taken in [E2](https://bugbountylibrary.com/r/sherlock%3A2023-03-taurus%3AH-2.md), a zeroed threshold makes a safety check always pass [E4](https://bugbountylibrary.com/r/c4%3A2022-04-abranft%3AH-04.md), an absurd rate drains a shared pool [E1](https://bugbountylibrary.com/r/c4%3A2023-01-popcorn%3AH-09.md).

## Where it shows up
- Parameters feeding `_withhold`, debt reduction, or balance decrements with no `<= PERCENT_PRECISION` check [E2](https://bugbountylibrary.com/r/sherlock%3A2023-03-taurus%3AH-2.md)
- Rate/speed setters (`changeRewardSpeed`, `rewardsPerSecond`) with no upper bound [E1](https://bugbountylibrary.com/r/c4%3A2023-01-popcorn%3AH-09.md)
- A parameter used as a multiplier or divisor inside a `require` safety check, where 0 or extreme values flip the outcome [E4](https://bugbountylibrary.com/r/c4%3A2022-04-abranft%3AH-04.md)
- Factory or controller code letting a user attach a shared singleton contract and then call its admin setters [E1](https://bugbountylibrary.com/r/c4%3A2023-01-popcorn%3AH-09.md)
- Per-`msg.sender` limits where a shared router is the sender, so the limit applies to aggregate balance [E3](https://bugbountylibrary.com/r/c4%3A2024-12-bakerfi-invitational%3AM-15.md)

## How to review
For every caller-supplied numeric parameter, trace it to its use. The invariant: any value used to move funds, reduce debt, or gate a check must be bounded to a documented range, and boundary values (0, max, >100%) must leave the check meaningful. Check setters that mutate shared state reachable by non-owners [E1](https://bugbountylibrary.com/r/c4%3A2023-01-popcorn%3AH-09.md). Check that safety checks cannot be made vacuous by a mutable parameter [E4](https://bugbountylibrary.com/r/c4%3A2022-04-abranft%3AH-04.md). Check that per-address limits key on the real user, not a shared intermediary [E3](https://bugbountylibrary.com/r/c4%3A2024-12-bakerfi-invitational%3AM-15.md).

## Variants seen
- Unbounded reward rate on a shared staking contract attached by any vault creator [E1](https://bugbountylibrary.com/r/c4%3A2023-01-popcorn%3AH-09.md)
- Unbounded proportion letting a semi-trusted keeper erase debt [E2](https://bugbountylibrary.com/r/sherlock%3A2023-03-taurus%3AH-2.md)
- Zeroed LTV threshold turning a health check into a no-op [E4](https://bugbountylibrary.com/r/c4%3A2022-04-abranft%3AH-04.md)
- Shared router counted against a per-wallet deposit cap, causing DoS [E3](https://bugbountylibrary.com/r/c4%3A2024-12-bakerfi-invitational%3AM-15.md)

## Impact and severity
High: near-total drain of reward tokens [E1](https://bugbountylibrary.com/r/c4%3A2023-01-popcorn%3AH-09.md), full debt erasure by a keeper [E2](https://bugbountylibrary.com/r/sherlock%3A2023-03-taurus%3AH-2.md), early collateral seizure [E4](https://bugbountylibrary.com/r/c4%3A2022-04-abranft%3AH-04.md), and deposit DoS [E3](https://bugbountylibrary.com/r/c4%3A2024-12-bakerfi-invitational%3AM-15.md). Severity rises when the parameter is settable by a low-privilege or semi-trusted role and mutates shared state.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-01-popcorn%3AH-09.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-03-taurus%3AH-2.md
- E3: https://bugbountylibrary.com/r/c4%3A2024-12-bakerfi-invitational%3AM-15.md
- E4: https://bugbountylibrary.com/r/c4%3A2022-04-abranft%3AH-04.md