NRDAX
CLI Submit

← registry

NRDAX-T0401 - Boundary-Check Off-By-One Index OOB Panic

compute_amp · active · first seen 2026-07-17

provenance: Reproduced in NullRabbit's attack-reproduction pipeline

mechanism

The node's proposal-ingest path bounds-checks an attacker-supplied `signer` slot index against the validator-set size using a strict `>` comparison instead of `>=`, so the boundary value `signer == num_validators` passes the check. That value is then used to index the validator array via `get_validator_by_slot_band`, causing an out-of-bounds access, and this happens before any signature verification, so an unauthenticated peer can gossip a single crafted, unsigned proposal to crash every receiving validator. Fix-class: correct the off-by-one bound check (or otherwise validate/clamp the index) prior to array indexing, closing the pre-auth OOB panic (CWE-125/193).

instances (2)

chainprimitivefidelityoriginreproducer (bundle)source
cosmos cosmos_tx_malformed_authinfo_nil_panic lab reverse-engineered-cve cosmos_tx_malformed_authinfo_nil_panic -
nimiq nimiq_proposal_signer_oob lab reverse-engineered-cve nimiq_proposal_signer_oob -

related (compute_amp)

NRDAX-T0005 - Array Deserialization Memcpy Corruption active NRDAX-T0006 - Async Runtime Blocking VM Execution active NRDAX-T0013 - Bloom Filter Divide-By-Zero Crash active NRDAX-T0076 - Expensive Debug RPC Compute Amplification active NRDAX-T0101 - Handshake Crypto Validation Bypass Crash active NRDAX-T0122 - Integer Signedness Index OOB Crash active NRDAX-T0129 - Invalid Curve Point Panic active NRDAX-T0139 - Legacy Sighash Quadratic CPU Blowup active

cite

https://nrdax.com/techniques/NRDAX-T0401

plain

NRDAX Registry. Technique NRDAX-T0401.

bibtex
@misc{nrdax_NRDAX_T0401,
  title = {Boundary-Check Off-By-One Index OOB Panic (NRDAX-T0401)},
  howpublished = {NRDAX Registry},
  url = {https://nrdax.com/techniques/NRDAX-T0401},
}
json (csl)
{
  "id": "nrdax-NRDAX-T0401",
  "type": "dataset",
  "title": "Boundary-Check Off-By-One Index OOB Panic (NRDAX-T0401)",
  "URL": "https://nrdax.com/techniques/NRDAX-T0401",
  "publisher": "NRDAX Registry"
}
badge

NRDAX-T0401 in the NRDAX registry

[![NRDAX-T0401 in the NRDAX registry](https://nrdax.com/badge/NRDAX-T0401.svg)](https://nrdax.com/techniques/NRDAX-T0401-boundary-check-off-by-one-index-oob-panic)

use from the CLI

Retrieve or cite this technique from a script or the terminal with the NRDAX Python library & CLI.

Retrieve this technique 
nrdax get NRDAX-T0401
Cite it (BibTeX) 
nrdax cite NRDAX-T0401 --format bibtex

CLI guide → GitHub ↗