diff --git a/pallets/helpers/Cargo.toml b/pallets/helpers/Cargo.toml
index 54d2641..61103e1 100644
--- a/pallets/helpers/Cargo.toml
+++ b/pallets/helpers/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "ghost-helpers"
-version = "0.0.11"
+version = "0.0.12"
 description = "Cryptographic utility suite for custom runtimes: optimized Bitmaps, UTXO parsing, Merkle Tree proofs, and Hash Chain components."
 license.workspace = true
 authors.workspace = true
diff --git a/pallets/helpers/src/utxo.rs b/pallets/helpers/src/utxo.rs
index 04948e5..f0fb40a 100644
--- a/pallets/helpers/src/utxo.rs
+++ b/pallets/helpers/src/utxo.rs
@@ -357,6 +357,9 @@ fn read_varint(bytes: &mut &[u8]) -> Result<usize, VarintError> {
                     .try_into()
                     .map_err(|_| VarintError::TypeConversionFailed)?,
             );
+            if val < 0xfd {
+                return Err(VarintError::TypeConversionFailed);
+            }
             *bytes = &bytes[2..];
             Ok(val as usize)
         }
@@ -369,6 +372,9 @@ fn read_varint(bytes: &mut &[u8]) -> Result<usize, VarintError> {
                     .try_into()
                     .map_err(|_| VarintError::TypeConversionFailed)?,
             );
+            if val < 0x10000 {
+                return Err(VarintError::TypeConversionFailed);
+            }
             *bytes = &bytes[4..];
             Ok(val as usize)
         }
@@ -381,6 +387,9 @@ fn read_varint(bytes: &mut &[u8]) -> Result<usize, VarintError> {
                     .try_into()
                     .map_err(|_| VarintError::TypeConversionFailed)?,
             );
+            if val < 0x100000000 {
+                return Err(VarintError::TypeConversionFailed);
+            }
             *bytes = &bytes[8..];
             Ok(val as usize)
         }
diff --git a/pallets/weaver/Cargo.toml b/pallets/weaver/Cargo.toml
index f474738..3b72278 100644
--- a/pallets/weaver/Cargo.toml
+++ b/pallets/weaver/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "ghost-weaver"
-version = "0.0.14"
+version = "0.0.15"
 description = "Weaving a secure cryptographic tapestry across different external chains."
 license.workspace = true
 authors.workspace = true
diff --git a/pallets/weaver/src/tests.rs b/pallets/weaver/src/tests.rs
index a6c2623..4fc1700 100644
--- a/pallets/weaver/src/tests.rs
+++ b/pallets/weaver/src/tests.rs
@@ -801,6 +801,116 @@ fn should_successfully_pull_utxo_thread_and_mint_currency() {
     });
 }
 
+#[test]
+fn should_successfully_pull_utxo_thread_and_reject_nominal_varint_encoding() {
+    let pair = AuthorityPair::from_string("//Alice", None).expect("Should be valid seed");
+    let incoming_share = 0;
+
+    let network_id = 69;
+    let network_data = NetworkDataBuilder::default()
+        .with_network_type(NetworkType::Utxo)
+        .with_incoming_share(incoming_share)
+        .with_gatekeeper(
+            // Transaction: https://blockstream.info/tx/4a3fdd9ebb30b9c6df05d4199f8474b2f0c795d1f40a58d0d73342fc666b4a2e
+            hex::decode("4635b1794a22bfbe6c5c5eba17b693f4aaf0e348")
+                .expect("Bytes32 from UTXO should be valid"),
+        )
+        .build();
+
+    let authorities = vec![pair.clone()];
+    let networks = vec![(network_id, network_data, Default::default())];
+
+    // Real world tx at block #481838
+    // Block https://blockstream.info/block/0000000000000000011bdccb39e19e942a60edffdccd9779653c5b46b337904a
+    // Transaction: https://blockstream.info/tx/4a3fdd9ebb30b9c6df05d4199f8474b2f0c795d1f40a58d0d73342fc666b4a2e
+
+    let payload = (
+        // curl --data-binary '{"jsonrpc": "2.0", "id": "test-proof", "method": "gettxoutproof", "params": [["4a3fdd9ebb30b9c6df05d4199f8474b2f0c795d1f40a58d0d73342fc666b4a2e"], "0000000000000000011bdccb39e19e942a60edffdccd9779653c5b46b337904a"]}' -H 'Content-Type: application/json' https://bitcoin-rpc.publicnode.com
+        hex::decode("00000020375a14cfcf5730daa8ff8d7a5bd2cf59fba797e289c2e0000000000000000000529cd017146361b57e6b7353b16d8d38d32f92ee842039dd779d35bfbfa2f3e53f649e59e93c01187900ea9fb40600000cfbd7b718845d123b1ae1a7fd3bce9c97acba097dc912c4ac67a920395db07ba4eef685960869ba70e0ca38890565c97dc11f1d7ae538e7b509069f81e38eff1a2e4a6b66fc4233d7d0580af4d195c7f0b274849f19d405dfc6b930bb9edd3f4a4c1f1e9fa3a336c50e8ea16039e4db4bef7ff5946e3a019937bdf626c2336d0e3926a83a575218f84e6dc55ffb9d0997a41e4b4d5425a85f22160c9f52362a95021a573ff96bb429bd80a8ec9dcb899971553efe91b6a0fe57c4694c3e8da8dc7f1babd514f2746da1ed06f08664baed853c334e0a3917d0c859b19ee14f448f77e624822070db3b606d5092027ca9ecf7e0243e6c151081021ebb3ddcdd28c1b8f9fdcffebd1962590477675f3d29d52602a1e7e941f772a3bbff42cf2eb6e74a1124bf424f767e294ae6253a21602c7c6b0381743dd6dcd57b025983e0e34375b24f67ac8beb00713d2f70594bbf797d5d94c061cb9965e6458f2f017f983d7ce37361fa13fda372f595dc1f22895ab93339457c72c480fed1c4d1164a242303ff3600").expect("Bytes32 from UTXO should be valid"),
+        // curl --data-binary '{"jsonrpc": "2.0", "id": "test-proof", "method": "getrawtransaction", "params": ["4a3fdd9ebb30b9c6df05d4199f8474b2f0c795d1f40a58d0d73342fc666b4a2e", false]}' -H 'Content-Type: application/json' https://bitcoin-rpc.publicnode.com
+        hex::decode("010000000299a43fae581f80baf44e021ddf7b11995f184db282d6e48c22248b9fe79c43bb010000008b483045022100e9db01784dcd879c65d66127c2d52a4f9244321d15796893d6dccadaa1146e3d02203d9bb80f8df8b66692d3d9517f7cbb898d7cc40a30b175432322e1956c9b973a0141048097e4f8bb8ee104d5c2ece11d42f7e4719df8ddba459ecadecaba87d233c81a3c14830371392dd8ed030ef970450c0b7af48d9db4ba20c046896481602eb9dbffffffffb3fd05bc6000a5a0384e9a613d452e9307568df0a964907068e00403a0a0e09e020000006a47304402205bb1cbad4b29421648c1e22cac32a56aa06c933fe655559823fffb71ffebbc0b022021648d970560aa5b2031560b52a0fd06305995a58a457663324c18c1a9b0bd0b8121020d6e50b2660af27933c42bc1395fe93df90ffac5e2a989f6a134919fb8cf8075ffffffff030000000000000000296a2769642b5bb666ac1657090d02985f0cdb41436fe2d5a83a3acb1995d963a698e7e619e927bdcc5e7c150000000000001976a914c1c69d91a5719a23ba2094d89a4df3eadfa4aef788acefea2309000000001976a9144635b1794a22bfbe6c5c5eba17b693f4aaf0e34888ac00000000").expect("Bytes32 from UTXO should be valid"),
+        vec![
+            // curl --data-binary '{"jsonrpc": "2.0", "id": "test-proof", "method": "getblockheader", "params": ["000000000000000000e7da64065cc23d5c5a5aa402f088aaaf37c5fe1c3b6b92", false]}' -H 'Content-Type: application/json' https://bitcoin-rpc.publicnode.com
+            hex::decode("000000204a9037b3465b3c657997cddcffed602a949ee139cbdc1b010000000000000000669c3e2472384bc95993f154aada38d6b2113d8d32069e32e2724ba40915a1802a669e59e93c011801c8c735").expect("Bytes32 from UTXO should be valid"),
+            // curl --data-binary '{"jsonrpc": "2.0", "id": "test-proof", "method": "getblockheader", "params": ["00000000000000000063da6d9362c0ac3b87877d1c5ad7afd5bd706571d5b393", false]}' -H 'Content-Type: application/json' https://bitcoin-rpc.publicnode.com
+            hex::decode("02000020926b3b1cfec537afaa88f002a45a5a5c3dc25c0664dae7000000000000000000af0f270bf3f868d47089f395197809c360f1506636c960d96afed68bbd72d0b4496d9e59e93c01183ac94b67").expect("Bytes32 from UTXO should be valid"),
+            // curl --data-binary '{"jsonrpc": "2.0", "id": "test-proof", "method": "getblockheader", "params": ["000000000000000000ec6063eb743366264368be7ff5021727682cb518963026", false]}' -H 'Content-Type: application/json' https://bitcoin-rpc.publicnode.com
+            hex::decode("0000002093b3d5716570bdd5afd75a1c7d87873bacc062936dda630000000000000000009ab437e7c66b10a59b67127f290d24f381aba4e03d5e16c062a356eea4d608dea56d9e59e93c0118264f310e").expect("Bytes32 from UTXO should be valid"),
+        ],
+    );
+
+    let encodings = vec![
+        vec![0x02],                                                 // canonical
+        vec![0xFD, 0x02, 0x00],                                     // non-minimal 3 bytes
+        vec![0xFE, 0x02, 0x00, 0x00, 0x00],                         // non-minimal 5 bytes
+        vec![0xFF, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00], // non-minimal 9 bytes
+    ];
+
+    new_test_ext(authorities, networks).execute_with(|| {
+        let session = 0;
+        let block_hash =
+            hex::decode("000000000000000000ec6063eb743366264368be7ff5021727682cb518963026")
+                .expect("Bitcoin Root hex should be valid");
+
+        let expected_root = H256::from_slice(&block_hash);
+        LoomStates::<TestRuntime>::insert(&network_id, &session, expected_root);
+
+        let expected_receiver_bytes = hex::decode("1657090d02985f0cdb41436fe2d5a83a3acb1995d963a698e7e619e927bdcc5e").unwrap();
+        let mut receiver_raw = [0u8; 32];
+        receiver_raw.copy_from_slice(&expected_receiver_bytes);
+
+        let receiver_account = sp_runtime::AccountId32::from(receiver_raw);
+        let transfer_amount: u64 = 153348847;
+        let mut expected_pure_amount: u64 = 0;
+
+        for (idx, enc) in encodings.iter().enumerate() {
+            let mut variant = Vec::with_capacity(payload.1.len() + enc.len() - 1);
+            variant.extend_from_slice(&payload.1[0..4]);
+            variant.extend_from_slice(&enc);
+            variant.extend_from_slice(&payload.1[5..]);
+
+            let utxo_thread_proof = UtxoThreadProof::new(payload.0.clone(), variant, payload.2.clone());
+            let thread_info = ThreadProof::UtxoThreadProof(utxo_thread_proof);
+            let pulled_thread_key = thread_info.get_unique_key(session, network_id);
+
+            assert_eq!(Balances::free_balance(&receiver_account), expected_pure_amount);
+            assert!(!PulledThreads::<TestRuntime>::contains_key(
+                &pulled_thread_key
+            ));
+
+            let pull_result = GhostWeaver::pull_thread(
+                RuntimeOrigin::none(),
+                network_id,
+                session,
+                thread_info
+            );
+
+            if idx == 0 {
+                assert!(pull_result.is_ok());
+                assert!(PulledThreads::<TestRuntime>::contains_key(&pulled_thread_key));
+
+                let curve_share = Perbill::from_parts(incoming_share).mul_ceil(transfer_amount);
+                expected_pure_amount += transfer_amount.saturating_sub(curve_share);
+
+                assert_eq!(Balances::free_balance(&receiver_account), expected_pure_amount);
+
+                System::assert_last_event(RuntimeEvent::GhostWeaver(Event::ThreadPulled {
+                    pulled_thread_key,
+                    network_id,
+                    receiver: receiver_account.clone(),
+                    amount: transfer_amount,
+                }));
+            } else {
+                assert!(pull_result.is_err());
+                assert!(!PulledThreads::<TestRuntime>::contains_key(&pulled_thread_key));
+                assert_eq!(Balances::free_balance(&receiver_account), expected_pure_amount);
+            }
+        }
+
+        assert_eq!(Balances::free_balance(&receiver_account), transfer_amount);
+    });
+}
+
 #[test]
 fn on_initialize_should_finalize_session_when_timeout_is_reached() {
     let pair1 = AuthorityPair::from_string("//Alice", None).expect("Should be valid seed");