Under-priced `System.Iterator.Value` re-deserializes attacker payloads on every call, exhausting node CPU and stalling block production
`System.Iterator.Value` is registered at a flat 16 datoshi while a `StorageIterator` created with `FindOptions.DeserializeValues` re-runs a full `BinarySerializer.Deserialize` of the attacker-controlled value (up to 65,535 bytes, deserializing to ~2,048 stack items) on every call — `Value()` does not advance the iterator and caches nothing, and under `PickField0`/`PickField1` the transient array is discarded so the VM reference counter never accounts for it. Measured through the real ApplicationEngine: 3,000 calls charged 0.0365 GAS while consuming 0.56s of node CPU, about 15 node-CPU-seconds per GAS paid, with a ~167× CPU spread between payloads for the identical flat fee; on a running local chain a single ~0.024 GAS transaction made a block persist in 778ms against 3.5ms for an empty block, so roughly 0.46 GAS per block sustains a full 15-second block time of CPU on every validating node, and no `MaxBlockSystemFee` cap bounds per-block system fees. Permissionless — a one-time ~10 GAS contract deployment plus ~8 GAS of stored payload, reusable across every later block; scored High per Neo's bounty taxonomy ("all network fail"), CVSS v3.1 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H).