# Broken NonceVoter Allows Observer to Halt the Chain

Deprecated NonceVoter msg server skips vote tallying and lets a single authorized observer set any chain nonce, desyncing UpdateNonce and halting cross-chain operations.

- Payout: Contest reward
- Severity: high
- Program: ZetaChain
- Credited: ciphermarco
- Disclosed: 2024-09-06
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-11-zetachain-findings/issues/547
- Library page: https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AH-01
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:go technique:source-review vuln:access-control vuln:business-logic

**Target:** Cosmos SDK crosschain module msg server (NonceVoter)
**Root cause:** NonceVoter only checks observer authorization then calls SetChainNonces directly; the multi-observer voting logic is commented out, so one observer's message overwrites the chain nonce.
**Steps:**
1. Start localnet: `make start-smoketest` in repos/node, exec into zetacore0
2. Get operator key via `zetacored keys list`
3. Submit `zetacored tx crosschain nonce-voter 18444 1337 --from ${operator_key} --fees "300azeta"` and confirm
4. Query `zetacored q crosschain list-chain-nonces`; observe chain 18444 nonce set to 1337
5. Repeat for other chains to desync all nonces
**How found:** Code reading of the crosschain keeper: noticed NonceVoter's voting logic was commented out/deprecated yet still reachable and directly calling SetChainNonces, then traced UpdateNonce's nonce-equality check to dependent critical functions.
**Exploitation:** A single authorized observer (faulty or compromised) submits MsgNonceVoter for each supported chain, overwriting stored nonces. UpdateNonce then fails the `p.NonceHigh != int64(nonce.Nonce)` check, causing MigrateTSSFundsForChain, ProcessCCTX, VoteOnObservedInboundTx/OutboundTx and WhitelistERC20 to error, halting cross-chain tx processing and stranding funds.
**Escalation:** Applying the overwrite across every supported chain halts all cross-chain operations chain-wide rather than a single chain.
**Insight:** Deprecated-but-reachable msg servers that bypass multi-party voting are prime targets in Cosmos modules; grep for commented-out tally logic and trace downstream equality/state checks to find single-actor state corruption with chain-wide DoS impact.