# Free blockchain storage – Tale of a bug in Substrate’s FRAME runtime

Substrate FRAME fee formula multiplied len_fee by a targeted_fee_adjustment that could reach zero, letting attackers submit arbitrarily large extrinsics for free.

- Payout: $250
- Severity: medium
- Program: Parity Technologies
- Credited: Mudit Gupta
- Disclosed: 2020-07-07
- Write-up quality: 6/10
- Original: https://mudit.blog/free-blockchain-storage-bug-substrate/
- Library page: https://bugbountylibrary.com/r/blog%3Amudit-blog-free-blockchain-storage-bug-substrate
- Tags: domain:web3 impact:dos impact:integrity kind:bounty platform:blog sev:medium tech:evm technique:source-review vuln:business-logic vuln:fee-bypass vuln:misconfiguration

**Target:** FRAME runtime transaction fee calculation (Substrate/Polkadot)
**Root cause:** len_fee was multiplied by targeted_fee_adjustment, and that multiplier could drop to zero on idle chains, zeroing out size and weight fees.
**Steps:**
1. Open https://polkadot.js.org/apps and go to the Extrinsics tab
2. Select the `system.remark` extrinsic
3. Upload a large payload via the file upload control
4. Submit the transaction; observe fee does not scale with payload size
**How found:** Reading the FRAME fee formula and comparing it against W3F docs, noticing len_fee was incorrectly scaled by targeted_fee_adjustment and that the multiplier's floor was zero.
**Exploitation:** Attacker submits a valid remark extrinsic with a multi-megabyte payload while the chain is idle (multiplier at zero), paying only base_fee and permanently storing arbitrary data on-chain for free.
**Insight:** When auditing fee/gas formulas, check each term's multiplier for a zero floor and whether size-based fees are decoupled from congestion multipliers per spec; an idle-chain multiplier of zero can nullify per-byte costs.