Skip to content
low Input Validation No SWC entry CWE-129

Array Index Used Without Bounds Assumption

SAFE-0255 Input Validation Checked automatically by the scanner
1

What goes wrong

A caller-supplied index is used to read/write an array or a mapping-of-structs whose existence isn't validated. Out-of-range or non-existent ids return zeroed structs that downstream logic treats as real, valid entries.

2

The vulnerable pattern

proof of concept — how it is exploited
// getOrder(id) returns orders[id]; a non-existent id returns a zeroed
// Order{maker:0, amount:0, filled:false}; fill() then treats it as open.
3

How to fix it

the pattern that is safe
require(id < items.length, "bad id");
Item storage it = items[id];
require(it.exists, "no item");
◆
Validate ids/indices and struct existence.
4

Where this has happened

Largest recorded losses in the same failure class — related, not the same bug:

$586M · 2022 BNB Chain Token Hub Input validation · 2022 $326M · 2022 Wormhole Input validation · 2022 $197M · 2023 Euler Finance Input validation · 2023 $190M · 2022 Nomad Bridge Input validation · 2022
5

Related vulnerabilities in Input Validation

SAFE-0073Missing Input Validation / Parameter Bounds medium · Input Validation SAFE-0074Array Length Mismatch in Batch Operations medium · Input Validation SAFE-0072Missing Zero-Address Validation low · Input Validation SAFE-0089Short Address / Calldata Padding (legacy) low · Input Validation SAFE-0140Missing Zero-Address Validation on Critical Setter low · Input Validation SAFE-0304Missing Zero-Value Validation on Value-Moving Function low · Input Validation
← PreviousCritical Entrypoints Not Pausable
Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0255 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs