Storage cost attacks - NEAR Docs

NEAR accounts must maintain a balance proportional to the data they store. If users can grow contract state without paying for it, an attacker can create enough entries to lock the contract’s available balance.

How the attack works

Consider a guest book that stores any message:

An attacker stores a message, for which the contract - not the visitor - pays the storage cost
An attacker repeats, storing thousands of inexpensive messages
More of the contract’s NEAR becomes locked for storage
The contract eventually lacks liquid balance for other operations

The attack is an economic imbalance: each write is cheap for the attacker but consumes balance belonging to the contract.

Charge for state growth

Measure the bytes written and require the attached deposit to cover them. The exact implementation depends on whether you charge per operation or use a storage-management standard.

#[payable]
pub fn add_message(&mut self, message: String) {
    let before = env::storage_usage();
    self.messages.push(message);
    let bytes_used = env::storage_usage() - before;
    let required = env::storage_byte_cost().saturating_mul(bytes_used.into());

    require!(
        env::attached_deposit() >= required,
        "Insufficient deposit for storage"
    );
}

If the deposit is insufficient, the panic reverts the state written by that receipt. Define what happens to any excess deposit and how users recover storage deposits when their data is removed.