[GHSA] GHSA-3whf-vgf2-9w6g (medium) — zaino-state has a Non-Finalized State Reorg — No Cycle Detection or Depth Limit

GHSA-3whf-vgf2-9w6g Severity: medium CVE: None

zaino-state has a Non-Finalized State Reorg — No Cycle Detection or Depth Limit

### Summary `NonFinalizedState::handle_reorg` is a recursive, unbounded async function that traverses parent blocks until it finds a common ancestor on the main chain. It has **no recursion depth limit** and **no cycle detection**. A malicious or buggy validator can serv