# MEV: Operator can bribe miner and steal honest operator's bond amount if gas price went high

Holograph's gas-spike check uses tx.gasprice, so an operator can bundle a low-gas executeJob with a coinbase bribe to steal an honest operator's bond.

- Payout: Contest reward
- Severity: high
- Program: Holograph
- Credited: Trust
- Disclosed: 2022-12-15
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-10-holograph-findings/issues/473
- Library page: https://bugbountylibrary.com/r/c4%3A2022-10-holograph%3AH-05
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained vuln:business-logic

**Target:** HolographOperator.executeJob() bond/slashing logic
**Root cause:** The gas-spike exemption compares the current tx.gasprice against the stored gasPrice, but tx.gasprice can be kept low while paying the miner via a separate coinbase bribe transaction in the same bundle.
**Steps:**
1. Honest primary operator misses their block slot due to a gas spike.
2. Attacker builds a flashbots bundle containing executeJob() with a low `tx.gasprice` (below stored gasPrice so the require passes) plus a separate transaction transferring a bribe to the coinbase address.
3. Miner accepts the bundle because total reward exceeds the low-gas tx alone.
4. executeJob() succeeds, attacker claims the primary operator's bond amount.
**How found:** Reading executeJob's gas-spike check and realizing tx.gasprice is attacker-controlled independent of actual miner compensation, which can be paid out-of-band via coinbase transfer in a bundle.
**Exploitation:** Attacker submits a flashbots bundle: executeJob() at low gasprice to satisfy `require(gasPrice >= tx.gasprice)` plus a coinbase bribe tx. Miner includes the bundle; attacker collects the victim operator's bond.
**Insight:** On-chain gas-price checks that gate slashing/bond logic are bypassable via flashbots coinbase bribes; also verify EIP-1559 assumptions across all target chains, since non-1559 chains allow sub-base-fee gas.