NRDAX-T0352 - Unvalidated Field Length Panic

state_import_abuse · active · first seen 2026-07-03

provenance: Reproduced in NullRabbit's attack-reproduction pipeline

mechanism

Agave snapshot AppendVec StoredMeta.data_len > MAX_PERMITTED_DATA_LENGTH (10 MiB) survives new_for_startup (sanitize skipped) -> index-gen scan_accounts QuotaExceeded -> .expect("must scan accounts st

instances (1)

chain	primitive	fidelity	origin	reproducer (bundle)	source
solana-agave	sol_snapshot_oversized_datalen_indexgen_panic	lab	NullRabbit Labs	sol_snapshot_oversized_datalen_indexgen_panic	github.com ↗

cite

https://nrdax.com/techniques/NRDAX-T0352

plain

NRDAX Registry. Technique NRDAX-T0352.

bibtex

@misc{nrdax_NRDAX_T0352,
  title = {Unvalidated Field Length Panic (NRDAX-T0352)},
  howpublished = {NRDAX Registry},
  url = {https://nrdax.com/techniques/NRDAX-T0352},
}

json (csl)

{
  "id": "nrdax-NRDAX-T0352",
  "type": "dataset",
  "title": "Unvalidated Field Length Panic (NRDAX-T0352)",
  "URL": "https://nrdax.com/techniques/NRDAX-T0352",
  "publisher": "NRDAX Registry"
}