CertiK Helped Fix a DoS Vulnerability in Solana’s Big-Integer Modular Exponentiation - CertiK

This report details a serious CU-accounting vulnerability in Solana's big_mod_exp syscall where byte/bit unit confusion underbills compute consumption, allowing 4,096-bit modular exponentiation calls to run far longer than charged and be retried repeatedly—enabling a remote DoS that was reproducible on a private cluster; the issue was reported by CertiK and mitigated by Solana via CU recalibration.