# Unbounded value blocks future actions

Untrusted or unvalidated value gates a later call; check who writes it and whether bounds hold

_Area: Smart contract access control and control flow. Seen in 9 disclosed reports; latest 2025-04-10. Updated 2026-10-23._

## How it works
A value that a later call must compare against (a max amount, expiry, cooldown, height, counter, or timestamp) is written from an untrusted or unvalidated source without a bound, or is left stale/zeroed. Once that value reaches an extreme or a sentinel, every subsequent call that must exceed or stay under it reverts or is rejected, so the flow is blocked. The broken assumption is that the setter is trusted, that the value stays in a sane range, or that a guard's precondition can always be met. The invariant that fails: the stored value consumed by a verification path must always be satisfiable by the next required call.

## Where it shows up
- A monotonic counter supplied by an untrusted party with no upper bound, saturating at uint64 max [E6](https://bugbountylibrary.com/r/c4%3A2025-01-initia-rollup-modules%3AM-06.md).
- A user-supplied duration/timestamp stored and later added to block.timestamp inside a loop over all entries [E8](https://bugbountylibrary.com/r/sherlock%3A2023-02-openq%3AH-1.md).
- A hard cap on stored identifiers (e.g. two hashes) that drops replacement/retry IDs [E4](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-11.md).
- Cooldown/timestamp guards keyed on an entity that can be removed and re-added, never reset on the lifecycle transition [E3](https://bugbountylibrary.com/r/c4%3A2023-12-ethereumcreditguild%3AM-20.md).
- State reset to zero (burn/unwrap) that silently disables a clamp for entities that still have children [E1](https://bugbountylibrary.com/r/c4%3A2022-07-ens%3AH-02.md).
- A timestamp guard written at creation but never reset when the guarded action ends early [E7](https://bugbountylibrary.com/r/c4%3A2024-07-reserve%3AM-07.md).
- A tick counter that only moves inside a function called at every entrypoint, whose max value makes that function revert [E5](https://bugbountylibrary.com/r/cantina%3Ainfinitypools_october2024%3A3.2.3.md).
- A per-call bound enforced on withdraw but not mirrored on stake [E2](https://bugbountylibrary.com/r/c4%3A2024-07-benddao%3AM-06.md).

## How to review
List every value that gates a future call. For each: who can write it, is there an upper and lower bound, and is it reset on lifecycle transitions? Grep setters and compare the setter's bounds against the consumer's bounds. The invariant: no untrusted party, and no reachable state transition, can set a value that a later required call cannot satisfy. Confirm the value consumed by the verification path is the same one stored in shared state, that zeroed sentinels do not disable clamps [E1](https://bugbountylibrary.com/r/c4%3A2022-07-ens%3AH-02.md), that caps on stake match caps on withdraw [E2](https://bugbountylibrary.com/r/c4%3A2024-07-benddao%3AM-06.md), and that guards are cleared when the guarded action terminates early [E7](https://bugbountylibrary.com/r/c4%3A2024-07-reserve%3AM-07.md). Test boundary values and exit paths under shutdown/pause.

## Variants seen
- Zeroed expiry on unwrap lets parent set a shorter expiry than children [E1](https://bugbountylibrary.com/r/c4%3A2022-07-ens%3AH-02.md).
- Missing stake cap exceeds protocol withdrawal limit, locking funds [E2](https://bugbountylibrary.com/r/c4%3A2024-07-benddao%3AM-06.md).
- Stale cooldown blocks re-offboarding a re-onboarded term [E3](https://bugbountylibrary.com/r/c4%3A2023-12-ethereumcreditguild%3AM-20.md).
- Hard cap of two stored hashes drops gas-bumped replacement hashes, stalling the outbound queue [E4](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-11.md).
- Tick counter at max makes advance() revert, bricking the pool [E5](https://bugbountylibrary.com/r/cantina%3Ainfinitypools_october2024%3A3.2.3.md).
- Unbounded proposer counter saturates, blocking bridge withdrawals [E6](https://bugbountylibrary.com/r/c4%3A2025-01-initia-rollup-modules%3AM-06.md).
- tradeEnd not reset on early settlement blocks new auctions [E7](https://bugbountylibrary.com/r/c4%3A2024-07-reserve%3AM-07.md).
- Max expiration overflows depositTime+expiration, reverting all refunds [E8](https://bugbountylibrary.com/r/sherlock%3A2023-02-openq%3AH-1.md).

## Impact and severity
Led to locked funds [E2](https://bugbountylibrary.com/r/c4%3A2024-07-benddao%3AM-06.md), a stalled outbound queue [E4](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-11.md), blocked bridge withdrawals [E6](https://bugbountylibrary.com/r/c4%3A2025-01-initia-rollup-modules%3AM-06.md), a permanently bricked pool [E5](https://bugbountylibrary.com/r/cantina%3Ainfinitypools_october2024%3A3.2.3.md), and permanently blocked refunds [E8](https://bugbountylibrary.com/r/sherlock%3A2023-02-openq%3AH-1.md). Severity rises when the setter is permissionless and the blocked flow is shared across all users. Distinguish permanent bricking [E4](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-11.md)[E5](https://bugbountylibrary.com/r/cantina%3Ainfinitypools_october2024%3A3.2.3.md)[E6](https://bugbountylibrary.com/r/c4%3A2025-01-initia-rollup-modules%3AM-06.md)[E8](https://bugbountylibrary.com/r/sherlock%3A2023-02-openq%3AH-1.md) from temporary DoS [E3](https://bugbountylibrary.com/r/c4%3A2023-12-ethereumcreditguild%3AM-20.md)[E7](https://bugbountylibrary.com/r/c4%3A2024-07-reserve%3AM-07.md) when calibrating.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2022-07-ens%3AH-02.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-07-benddao%3AM-06.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-12-ethereumcreditguild%3AM-20.md
- E4: https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-11.md
- E5: https://bugbountylibrary.com/r/cantina%3Ainfinitypools_october2024%3A3.2.3.md
- E6: https://bugbountylibrary.com/r/c4%3A2025-01-initia-rollup-modules%3AM-06.md
- E7: https://bugbountylibrary.com/r/c4%3A2024-07-reserve%3AM-07.md
- E8: https://bugbountylibrary.com/r/sherlock%3A2023-02-openq%3AH-1.md