EPIC-SEC-001CRITICALTarget: Memory Boundaries
Account Layout Allocation & Resize Checks
Description
Asserts realloc size boundary checks.
Technical Rationale
Solana program account sizes can be resized dynamically up to account storage limits. Without strict size boundary assertions preceding the realloc instruction, a malicious instruction could expand state parameters arbitrarily, triggering account rent exhaustion or stack overflows.
Code Assessment Examples
Insecure Practice
// Vulnerable: Account is resized dynamically based on user input size
let new_size = account.data_len() + extra_bytes;
account.realloc(new_size, false)?; Secure Resolution
// Safe: Reallocation size is checked against a maximum threshold
let new_size = account.data_len() + extra_bytes;
require!(new_size <= MAX_STATE_LIMIT, ErrorCode::ExceedsLimit);
account.realloc(new_size, false)?;