Posts tagged with

QA-01: No Deduplication of Peers in ConfirmGroup Allows Traffic Amplification

v vielite
April 2, 2026
1 min read

Duplicate node IDs in ConfirmGroup can force redundant sends.
Code4rena QA

monad qa paid
QA-02: Deterministic RNG in BlockSync Peer Selection

v vielite
April 1, 2026
0 min read

A fixed RNG seed makes peer selection predictable across runs.
Code4rena QA

monad qa paid
QA-03: BlockSync Processes Invalid Peer Data Without Penalty

v vielite
March 31, 2026
0 min read

Peers can trigger expensive verification and remain eligible for reselection.
Code4rena QA

monad qa paid
QA-04: Empty Validator Set Can Be Accepted in ValidatorSetFactory

v vielite
March 30, 2026
2 min read

A zero-stake validator set can be constructed from empty input.
Code4rena QA

monad qa paid
QA-05: Positional Trailing Fields Can Be Misparsed in ConsensusBlockHeader

v vielite
March 29, 2026
0 min read

Trailing optional fee fields are decoded by position rather than presence flags.
Code4rena QA

monad qa paid
QA-06: Unchecked Subtraction in Emptying Transaction Threshold Can Underflow

v vielite
March 28, 2026
0 min read

A zero execution delay can trigger a panic in the threshold comparison.
Code4rena QA

monad qa paid
QA-07: Unbounded Accumulation of Future Round Votes in VoteState

v vielite
March 27, 2026
1 min read

Votes for arbitrary future rounds can accumulate without a hard upper bound.
Code4rena QA

monad qa paid
QA-08: Txpool Admission Ignores Value and max_fee_per_gas

v vielite
March 26, 2026
0 min read

The txpool can admit insolvent transactions.
Code4rena QA

monad qa paid
QA-09: ConsensusMessage Late Version Validation Allows Resource Exhaustion

v vielite
March 25, 2026
1 min read

Wrong-version messages still incur expensive nested decoding work.
Code4rena QA

monad qa paid
QA-10: Discrepancy Between Documentation and Codebase in EIP-1559 Enabling TFM

v vielite
March 24, 2026
12 min read

Documentation and configuration disagree on TFM support.
Code4rena QA

monad qa paid
QA-11: Potential Per-Entry Memory Leak in traverse_callback

v vielite
March 23, 2026
1 min read

Traversal callbacks copy key and value buffers without finalizing FFI allocations.
Code4rena QA

monad qa paid
QA-12: Order Assumption in get_account_base_nonces Can Misassign Nonces

v vielite
March 22, 2026
1 min read

The nonce path assumes backend result ordering without requiring it.
Code4rena QA

monad qa paid
QA-13: Unconditional Timer Reset on Unknown Seqnum in complete_polled_requests

v vielite
March 21, 2026
1 min read

Unknown sequence numbers can still pace the preload timer.
Code4rena QA

monad qa paid
QA-14: monad_event_ring_try_copy Leaks Stale Descriptor Content on Failure

v vielite
March 20, 2026
0 min read

The function copies descriptor content before validating the sequence number.
Code4rena QA

monad qa paid