# Parallel array length mismatch reverts

Parallel arrays or selector/plugin lists consumed by index without equal-length validation, causing reverts or locked funds

_Area: Smart contract access control and control flow. Seen in 6 disclosed reports; latest 2026-03-13. Updated 2026-10-23._

## How it works
Code builds or stores two arrays that are meant to be parallel (amounts vs max amounts, selectors vs plugins, token ids vs floor tokens, counts across chains) and later consumes them by shared index or asserts their lengths match. If one array is shorter, longer, or grew after the other was fixed, the index access goes out of bounds or an equality check fails and the call reverts. The broken assumption is that the two arrays stay the same length across every path that touches them.

## Where it shows up
- A helper builds one array with a skip-index or assembly truncation while the other keeps full length [E3](https://bugbountylibrary.com/r/sherlock%3A2023-07-blueberry%3AM-12.md).
- A struct field meaningful only for some order types is stored without emptiness/length checks, then consumed in exercise/withdraw [E1](https://bugbountylibrary.com/r/c4%3A2022-06-putty%3AH-03.md).
- Two arrays stored in one function (propose) and indexed together in another (install) [E5](https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AH-19.md).
- A length/count equality check against destination-side state that can change after send [E2](https://bugbountylibrary.com/r/c4%3A2024-02-tapioca%3AM-19.md).
- A modifier or gate that inspects a fixed index (e.g. index 0) of an array that routines reorder [E4](https://bugbountylibrary.com/r/c4%3A2022-11-debtdao%3AH-01.md).

## How to review
For every pair of arrays or list-plus-index structure, trace all producers and consumers. The invariant: at each consumption point, the arrays passed together have equal length, and any index used is within both. Check storage boundaries (validate at write, not only at read) [E5](https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AH-19.md), assembly/truncation paths [E3](https://bugbountylibrary.com/r/sherlock%3A2023-07-blueberry%3AM-12.md), and cross-chain checks against mutable remote state [E2](https://bugbountylibrary.com/r/c4%3A2024-02-tapioca%3AM-19.md). For index-0 gates, confirm no routine reorders the array before the gate runs [E4](https://bugbountylibrary.com/r/c4%3A2022-11-debtdao%3AH-01.md).

## Variants seen
- Assembly length truncation mismatching Balancer joinPool arrays [E3](https://bugbountylibrary.com/r/sherlock%3A2023-07-blueberry%3AM-12.md).
- Unvalidated struct field for one order type breaking exercise/withdraw [E1](https://bugbountylibrary.com/r/c4%3A2022-06-putty%3AH-03.md).
- Missing length check at propose, revert at install, permanent lock [E5](https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AH-19.md).
- Stale cross-chain count equality stranding a message [E2](https://bugbountylibrary.com/r/c4%3A2024-02-tapioca%3AM-19.md).
- Reordered array making a modifier inspect the wrong element [E4](https://bugbountylibrary.com/r/c4%3A2022-11-debtdao%3AH-01.md).

## Impact and severity
High: funds and NFTs locked forever [E1](https://bugbountylibrary.com/r/c4%3A2022-06-putty%3AH-03.md)[E5](https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AH-19.md), stranded cross-chain messages burning tokens [E2](https://bugbountylibrary.com/r/c4%3A2024-02-tapioca%3AM-19.md), blocked insolvency declaration [E4](https://bugbountylibrary.com/r/c4%3A2022-11-debtdao%3AH-01.md), failed position opens [E3](https://bugbountylibrary.com/r/sherlock%3A2023-07-blueberry%3AM-12.md). Worse when the revert is on an irreversible path (migration, exercise, cross-chain delivery) with no retry.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2022-06-putty%3AH-03.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-02-tapioca%3AM-19.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-07-blueberry%3AM-12.md
- E4: https://bugbountylibrary.com/r/c4%3A2022-11-debtdao%3AH-01.md
- E5: https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AH-19.md