NRDAX-T0352 - Unvalidated Field Length Panic

Fault termination · Sync and state import · absent invariant · active · first seen 2026-07-03

provenance: Reproduced in NullRabbit's attack-reproduction pipeline

mechanism

Agave snapshot AppendVec StoredMeta.data_len > MAX_PERMITTED_DATA_LENGTH (10 MiB) survives new_for_startup (sanitize skipped) -> index-gen scan_accounts QuotaExceeded -> .expect("must scan accounts storage") panic; pre-hash-gate bootstrap crash. Out-of-scope per Anza SECURITY.md (maliciously-crafted-snapshots / bootstrap-config-mitigable) -> publishable. source_class=original.

live exposure

No exposure data. Slashr ↗ has no risk signal mapped to this technique yet — absence of data is not absence of exposure.

research

In-depth write-ups of this attack on nullrabbit.ai.

Crashing an Agave validator during snapshot bootstrap with one oversized account length ↗

instances (4)

chain	primitive	fidelity	origin	reproducer (bundle)	source
conflux	conflux_snapshot_chunk_overlong_key_path_steps_panic	lab	reverse-engineered-cve	conflux_snapshot_chunk_overlong_key_path_steps_panic	github.com ↗
quic	quiche_0rtt_packet_len_panic	lab	reverse-engineered-cve	quiche_0rtt_packet_len_panic	-
quic	quiche_payload_overflow_crash	lab	reverse-engineered-cve	quiche_payload_overflow_crash	-
solana-agave	sol_snapshot_oversized_datalen_indexgen_panic	lab	NullRabbit Labs	sol_snapshot_oversized_datalen_indexgen_panic	github.com ↗

related (Fault termination)

NRDAX-T0001 - Addr Message Counter Overflow Crash active NRDAX-T0005 - Array Deserialization Memcpy Corruption active NRDAX-T0013 - Bloom Filter Divide-By-Zero Crash active NRDAX-T0024 - Compact Block FillBlock Duplicate Crash active NRDAX-T0056 - Duplicate Input Validation-Bypass Crash active NRDAX-T0101 - Handshake Crypto Validation Bypass Crash active NRDAX-T0120 - Integer-Overflow Panic Control Message active NRDAX-T0122 - Integer Signedness Index OOB Crash active

cite

https://nrdax.com/techniques/NRDAX-T0352

plain

NRDAX Registry. Technique NRDAX-T0352.

bibtex

@misc{nrdax_NRDAX_T0352,
  title = {Unvalidated Field Length Panic (NRDAX-T0352)},
  howpublished = {NRDAX Registry},
  url = {https://nrdax.com/techniques/NRDAX-T0352},
}

json (csl)

{
  "id": "nrdax-NRDAX-T0352",
  "type": "dataset",
  "title": "Unvalidated Field Length Panic (NRDAX-T0352)",
  "URL": "https://nrdax.com/techniques/NRDAX-T0352",
  "publisher": "NRDAX Registry"
}

badge

[![NRDAX-T0352 in the NRDAX registry](https://nrdax.com/badge/NRDAX-T0352.svg)](https://nrdax.com/techniques/NRDAX-T0352-unvalidated-field-length-panic)

use from the CLI

Retrieve or cite this technique from a script or the terminal with the NRDAX Python library & CLI.

Retrieve this technique

nrdax get NRDAX-T0352

Cite it (BibTeX)

nrdax cite NRDAX-T0352 --format bibtex

CLI guide → GitHub ↗