# Gas price spikes cause the selected operator to be vulnerable to frontrunning and be slashed

HolographOperator's gas-spike guard lets rival operators frontrun a stalled selected operator and slash its bond once an epoch passes.

- Payout: Contest reward
- Severity: high
- Program: Holograph
- Credited: Chom
- Disclosed: 2022-12-15
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-10-holograph-findings/issues/44
- Library page: https://bugbountylibrary.com/r/c4%3A2022-10-holograph%3AH-06
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** HolographOperator.sol operator job execution/slashing
**Root cause:** The gasPrice >= tx.gasprice guard makes the selected operator wait out gas spikes without submitting, while other operators can queue a job tx with a high gasPrice in bridgeInRequestPayload and execute first, then slash the selected operator after one epoch.
**Steps:**
1. Selected operator's job tx is blocked by `require(gasPrice >= tx.gasprice, "HOLOGRAPH: gas spike detected")` during a gas spike, so it submits nothing.
2. Rival operator submits a tx with `gasPrice in bridgeInRequestPayload` to the mempool, executing the job before the selected operator.
3. After `require(timeDifference > 0, "HOLOGRAPH: operator has time")` (one epoch passes), rival calls slashing: `_bondedAmounts[job.operator] -= amount; _bondedAmounts[msg.sender] += amount;`.
4. Rival gains the slashed bond, outweighing the small gas fee risk.
**How found:** Reading the gas-spike guard and slashing logic together: the guard incentivizes the selected operator to withhold its tx, creating a window where others can execute first and slash.
**Exploitation:** Rival operators monitor mempool/gas spikes, queue a job execution tx with elevated gasPrice to beat the stalled selected operator, then trigger slashing after one epoch to collect the pod base fee bond.
**Insight:** When a protocol adds a 'fairness' guard that makes an actor withhold its transaction (e.g. waiting out gas spikes), check whether rivals can still submit and profit from the resulting inaction via slashing or reward capture.