# An attacker can lock operator out of the pod by setting gas limit that's higher than the block gas limit of dest chain

Unbounded user-set gasLimit above dest chain block gas limit makes operator job always revert, locking operator's bond and pod slot.

- Payout: Contest reward
- Severity: high
- Program: Holograph
- Credited: 0xA5DF
- Disclosed: 2022-12-15
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-10-holograph-findings/issues/414
- Library page: https://bugbountylibrary.com/r/c4%3A2022-10-holograph%3AH-01
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** HolographOperator.sol executeJob gas check
**Root cause:** Job execution requires gasleft() >= user-supplied gasLimit, but gasLimit is unbounded, so a value above the destination chain's block gas limit can never be satisfied.
**Steps:**
1. Attacker submits a bridge/beam job with `gasLimit` set above dest chain block gas limit (e.g. 50M on a 20M-limit chain).
2. Job is dispatched to operator pod on dest chain.
3. Operator calls executeJob; check `gasleft() >= gasLimit` at HolographOperator.sol#L415 always reverts `HOLOGRAPH: not enough gas left`.
4. Operator cannot execute any further jobs and cannot recover bond.
**How found:** Code review of the gas requirement check in executeJob; noticed gasLimit is user-controlled with no upper bound, then reasoned a value exceeding block gas limit makes the check unsatisfiable, confirmed via modified test setting gasLimit to 5M/50M.
**Exploitation:** Attacker pays only the dest-chain gas fee equivalent (gasPrice*gasLimit, cheap on Polygon/Avalanche) to submit the malicious job; the operator's pod slot is permanently stuck since the gas requirement is unsatisfiable, and the operator forfeits their bond.
**Insight:** When a contract enforces `gasleft() >= userSuppliedLimit`, check whether the limit is bounded by the destination chain's block gas limit; unbounded user gas parameters can create unsatisfiable execution conditions that grief bonded operators.