# Gas pricing can be used to extort funds from users of SChain owner

Node submits messages with unbounded tx.gasprice, so refundGasByUser drains the user's or SChain owner's ETH balance via inflated gas refunds.

- Payout: Audit contest
- Severity: high
- Program: SKALE
- Found by: kirk-baird
- Disclosed: 2022-11-11
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-02-skale-findings/issues/28
- Library page: https://bugbountylibrary.com/r/c4%3A2022-02-skale%3AH-02
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** CommunityPool.refundGasByUser / MessageProxyForMainnet on Ethereum
**Root cause:** Refund amount is computed as tx.gasprice * gas with tx.gasprice fully controlled by the submitting node and no upper bound, so the node can inflate the refund arbitrarily.
**Steps:**
1. Node collates SChain exits and calls MessageProxyForMainnet.postIncomingMessages with a very high tx.gasprice (EIP1559 tip is arbitrary).
2. For each registered destination, refundGasByUser(fromSchainHash, msg.sender, receiver, gasUsed) computes amount = tx.gasprice * gas.
3. amount is capped only by _userWallets[user][schainHash]; node receives node.sendValue(amount).
4. If user balance insufficient, activeUsers[user][schainHash] is set false and a lock-user message is posted to SChain, blocking further exits.
**How found:** Code review of refundGasByUser noting refund uses tx.gasprice directly; recognized EIP1559 tip is attacker-controlled and unbounded, and that the submitter is the refund recipient.
**Exploitation:** A collating node sets an excessive tx.gasprice on the batch transaction; since the node is refunded its own gas, it loses nothing while draining the initiating user's wallet balance, or the SChain owner's balance when the user is underfunded.
**Escalation:** Repeated batches drain balances and lock users out of further exits via the lock-user message, extorting users/owner.
**Insight:** When a contract reimburses the transaction submitter using tx.gasprice, the submitter controls that value; check every refund/reimbursement path for a gas-price oracle or cap, especially where the payer is a different party than the submitter.