# Cronos Theft of Transactions Fees Bugfix Review

Missing ExtensionOptionsEthereumTx on a cosmos-signed MsgEthereumTx skipped EthGasConsume, letting attacker claim uncharged gas refunds and steal block fees.

- Payout: $40,000
- Severity: high
- Program: Cronos
- Credited: Zb3
- Disclosed: 2022-01-21
- Write-up quality: 7/10
- Original: https://immunefi.com/blog/bug-fix-reviews/cronos-theft-of-transactions-fees-bugfix-review/
- Library page: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-cronos-theft-of-transactions-fees-bugfix-review
- Tags: domain:web3 impact:funds-loss kind:bounty platform:blog platform:immunefi sev:high tech:evm technique:chained technique:source-review vuln:business-logic

**Target:** Ethermint/Cosmos SDK antehandler transaction routing
**Root cause:** No check that a MsgEthereumTx carries ExtensionOptionsEthereumTx, so the EthGasConsume antehandler is skipped and gas is never deducted, yet the post-execution refund still pays out.
**Steps:**
1. Construct a MsgEthereumTx with a valid Ethereum signature but omit ExtensionOptionsEthereumTx.
2. Sign it with a cosmos signature and set an arbitrarily high GasLimit.
3. Submit directly to a node (not via the JSON-RPC endpoint that auto-appends the extension).
4. Only standard antehandlers run; EthGasConsumeDecorator is skipped so gas cost is not deducted.
5. After execution the gas refund is credited, yielding uncharged funds equal to gasPrice*gasLimit.
**How found:** Researcher reasoned about the dual Cosmos/EVM transaction routing: the JSON-RPC path appends ExtensionOptionsEthereumTx to trigger EthGasConsume, but nothing enforces its presence, so submitting a MsgEthereumTx directly skips fee deduction while refund logic still runs.
**Exploitation:** Attacker submits cosmos-signed MsgEthereumTx without ExtensionOptionsEthereumTx and a high GasLimit; gas is never charged but the refund is paid, seizing the current block's transaction fees. Repeatable every block.
**Escalation:** Repeatable per block, allowing continuous siphoning of block transaction fees.
**Insight:** On dual-runtime chains (Cosmos+EVM), compare the two transaction entry paths: the RPC path adds metadata/extension options that gate fee and signature antehandlers. Try submitting the raw SDK message directly to bypass those gated handlers and look for refund/settlement logic that assumes the charge already happened.