# Unmetered resource exhausts node

Guest-controlled output or expensive ops priced flat or unbounded, crossing into host memory

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2025-04-10. Updated 2026-10-24._

## How it works
A runtime charges for some work but not all of it. One output channel or one class of operation is bounded or priced, while a sibling channel or instruction is left free or flat-priced. A guest (WASM program, EVM transaction) can then produce work far out of proportion to what it pays, and the host node absorbs the cost in CPU or memory until it fails. The broken assumption is that bounding or pricing one path covers the others.

## Where it shows up
- A size limit on execution results but none on stdout/stderr buffers [E1](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-5.md)
- Guest output copied across an FFI boundary (Rust/Go via CGO) and stored without a cap [E1](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-5.md)
- Gas metering with a flat per-operation cost and only a few special cases [E3](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-4.md)
- Expensive instructions (TableGrow, MemoryFill, MemoryInit, TableCopy, transcendental math) priced like cheap ones [E3](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-4.md)
- EVM call/create paths that skip intrinsic gas while still granting warm-access discounts [E2](https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-05.md)
- Access-list entries paid via tx-size instead of the 2600/2100 upfront charge [E2](https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-05.md)

## How to review
Enumerate every channel where guest-controlled data or work reaches host resources, and confirm each has a bound or a price proportional to its real cost. For output: every buffer (results, stdout, stderr) must have an enforced maximum before it crosses FFI or is stored [E1](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-5.md). For metering: walk the full operator/instruction table and check that no expensive op falls through to a flat default [E3](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-4.md). For EVM ports: confirm intrinsic gas, including access-list costs, is deducted before execution, since warm/cold logic assumes it was paid [E2](https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-05.md). The invariant: cost charged >= resource consumed, on every path, with no unbounded sibling channel.

## Variants seen
- Unbounded stdout/stderr while results were capped [E1](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-5.md)
- Flat gas for all non-accounting ops, expensive instructions underpriced [E3](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-4.md)
- Missing intrinsic gas charge enabling cheap access-list abuse [E2](https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-05.md)

## Impact and severity
High: OOM of validators during endblock tally [E1](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-5.md), network-wide DoS via resource exhaustion [E3](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-4.md), and cheap computational-resource abuse [E2](https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-05.md). Severity rises when the unbounded path runs in consensus-critical processing (endblock) or is reachable by any submitted request, and when the cost gap is large (300 vs 2600 gas).

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-5.md
- E2: https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-05.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-4.md