# Attacker can block LayerZero channel due to missing check of minimum gas passed

Tapioca's lzSend accepts arbitrary adapterParams gas, so an attacker can send a message with ~50k gas that reverts on the destination, storing the payload and blocking the LayerZero channel.

- Payout: Contest reward
- Severity: high
- Program: Tapioca DAO
- Credited: windhustler
- Disclosed: 2023-11-16
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-07-tapioca-findings/issues/1207
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-17
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm technique:chained technique:source-review vuln:dos vuln:misconfiguration

**Target:** LayerZero NonBlockingLzApp / tOFT lzSend adapterParams
**Root cause:** Contracts inheriting NonBlockingLzApp override lzSend without validating the gas limit in adapterParams, so a sender can specify gas too low to reach the try/catch in lzReceive, causing the endpoint to store the payload and block the pathway.
**Steps:**
1. Call `triggerSendFrom` on BaseTOFT with `airdropAdapterParams` specifying ~50k gas limit.
2. Relayer delivers the message with exactly that gas via `{gas: _gasLimit}` in Endpoint.
3. Execution reverts before reaching NonblockingLzApp's try/catch, so Endpoint stores the payload as `StoredPayload`.
4. Channel between the two lzApps is now blocked; repeat cheaply to keep it blocked.
**How found:** Noticed lzSend invocations naively assume a minimum 200k gas is enforced, but adapterParams is user-controlled; built a Foundry PoC NonBlockingLzApp sending only 30k gas and confirmed via Tenderly/LayerZeroScan that the destination reverts and stores the payload.
**Exploitation:** Attacker repeatedly sends cross-chain messages with minimal adapterParams gas (~50k), each reverting on destination and leaving a StoredPayload, blocking the pathway between any two chains at low cost and high frequency, making the system unusable.
**Insight:** When a contract inherits NonBlockingLzApp, verify the override of `_lzSend` extracts and enforces a minimum gas limit from adapterParams per packet type; otherwise a cheap low-gas message bypasses the try/catch and permanently blocks the channel via StoredPayload.