You can set max length in XDR like: `Operation operations<MAX_OPS_PER_TX>` so without checking the length you can create value that is not valid. Similar issue: https://github.com/nullstyle/go-xdr/pull/4