if you're auditing move contracts on aptos, always check what map type they're using for permissionless data.
SimpleMap is vector-backed. every lookup is a linear scan. if anyone can add entries, an attacker can bloat it until every operation runs out of gas...mint, burn, liquidate, all bricked.
aptos has multiple map types & picking the wrong one is a security bug
→ SimpleMap (deprecated) / OrderedMap: bounded, single slot. never for unbounded permissionless data
→ Table: unbounded, one slot per key. safe but no iteration
→ BigOrderedMap: unbounded, b tree, concurrent, grows dynamically
simplemap & smarttable are both deprecated but still in production codebases. the data structure layer is where some of the highest impact dos bugs hide.