diff --git a/executor/crates/calldata/src/bin.rs b/executor/crates/calldata/src/bin.rs
index 1116a961e..39f83ed42 100644
--- a/executor/crates/calldata/src/bin.rs
+++ b/executor/crates/calldata/src/bin.rs
@@ -210,6 +210,10 @@ impl Parser<'_> {
                     if full_size == 0 {
                         Value::Array(Vec::new())
                     } else {
+                        const MAX_ARRAY_CAPACITY: usize = 1024 * 1024; // 1M elements max
+                        if full_size > MAX_ARRAY_CAPACITY {
+                            return Err(anyhow::anyhow!("array capacity too large: {}", full_size));
+                        }
                         stack.push(Frame::Array {
                             collected: Vec::with_capacity(full_size),
                             remaining: full_size,
diff --git a/executor/src/wasi/genlayer_sdk.rs b/executor/src/wasi/genlayer_sdk.rs
index 804f8fa2c..1d2d1b9fa 100644
--- a/executor/src/wasi/genlayer_sdk.rs
+++ b/executor/src/wasi/genlayer_sdk.rs
@@ -1301,6 +1301,11 @@ impl ContextVFS<'_> {
             }
             Some(data) => {
                 use crate::public_abi::ResultCode;
+                if data.is_empty() {
+                    return Err(generated::types::Error::trap(
+                        crate::anyhow_to_wasmtime(anyhow::anyhow!("leader nondet result is empty"))
+                    ));
+                }
                 let rest = &data[1..];
                 let res = match data[0] {
                     x if x == ResultCode::Return as u8 => rt::vm::RunOk::Return(rest.into()),