# DoS of user operations and loss of user transaction fee due to insufficient gas value submission by malicious bundler

Malicious bundler submits high-gas user ops with insufficient gas value, causing innerHandleOp call to fail while user/paymaster still pays.

- Payout: Contest reward
- Severity: medium
- Program: Biconomy
- Credited: peakbolt
- Disclosed: 2023-03-03
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-01-biconomy-findings/issues/303
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-biconomy%3AM-05
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** ERC-4337 EntryPoint smart contract (innerHandleOp/handleOps)
**Root cause:** innerHandleOp() calls the user op with mUserOp.callGasLimit without verifying gasLeft() is sufficient to cover callGasLimit and verificationGasLimit, so a bundler can supply too little gas and force the call to fail.
**Steps:**
1. Bundler collects high-gas user operations from the UserOperation mempool.
2. Bundler calls handleOps() with a gas value insufficient to cover the specified mUserOp.callGasLimit.
3. innerHandleOp() executes `address(mUserOp.sender).call{gas: mUserOp.callGasLimit}(callData)` but remaining gas is too low, so the call reverts/fails.
4. Post-op logic still charges the user/paymaster for the execution despite the failed operation.
**How found:** Code review of EntryPoint.sol innerHandleOp() noting the call forwards mUserOp.callGasLimit without checking gasLeft() against callGasLimit/verificationGasLimit, cross-referenced against the upstream eth-infinitism fix commit.
**Exploitation:** A malicious bundler includes victim user operations in a bundle but supplies insufficient gas so the inner call fails; the user operation is marked failed yet the user/paymaster is still charged, causing DoS and fee loss.
**Insight:** In ERC-4337-style account abstraction, check that gasLeft() at the inner call site exceeds callGasLimit+verificationGasLimit; otherwise a bundler controls gas supply and can force failures while still charging the paymaster.