A security researcher details the discovery of a chain-halting DoS vulnerability in Injective's Peggy Bridge during a Code4rena audit. The bug stems from unbounded state accumulation in the rate limiting module: every bridge transfer appends to an uncapped slice, and the Cosmos SDK EndBlocker iterates over all tokens × all transfers on every block, creating O(N×M) complexity. An attacker can bloat state with dust transactions across many tokens, causing CPU exhaustion that exceeds consensus timeouts and halts the chain. A PoC unit test confirmed 100% CPU spike. The recommended fix involves hard caps on the Transfers slice and efficient KVStore indexing using composite keys for range-based pruning.
Table of contents
The Target: Injective’s Peggy BridgeThe Vulnerability: A Ticking Time BombGet Hacker MD ’s stories in your inboxThe Exploit MechanismBuilding the Proof of Concept (PoC)The FixConclusion382 Impressions