# A malicious inbound transaction can prevent subsequent events from being processed by observers

Oversized message in an inbound Zeta transaction makes PostSend fail, aborting the observer loop and skipping all later events in the block range.

- Payout: Contest reward
- Severity: high
- Program: ZetaChain
- Credited: berndartmueller ([1](https://github.com/code-423n4/2023-11-zetachain-findings/issues/416)
- Disclosed: 2024-09-06
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-11-zetachain-findings/issues/416
- Library page: https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AH-04
- Tags: domain:web3 impact:dos impact:integrity kind:contest platform:code4rena sev:high tech:go technique:source-review vuln:dos

**Target:** zetaclient ExternalChainWatcher observeInTX (EVM observer)
**Root cause:** observeInTX returns early when PostSend errors on an invalid (too-long) message, but still advances lastBlockHeightScanned to toBlock, so unprocessed events in that range are never retried.
**Steps:**
1. Deploy contract calling ZetaConnectorEth.send with message length 10240 (base64 inflates to >MaxMessageLength 10240).
2. Send a second legitimate ZetaSent event in a later tx/block.
3. Observer picks up malicious event, PostSend fails with 'message is too long: 13656'.
4. observeInTX returns early but sets lastBlockHeightScanned=toBlock.
5. Subsequent legitimate event is never processed/voted.
**How found:** Code review of observeInTX: noticed PostSend error path returns early while lastBlockHeightScanned is still updated at end of function, meaning failed blocks are skipped rather than retried.
**Exploitation:** Attacker sends a ZetaConnectorEth.send (or ERC20Custody.deposit) with an oversized message; the observer's PostSend to zetacore fails ValidateBasic, the loop returns, and toBlock is committed as scanned, silently dropping all other inbound events in that block range.
**Insight:** When an observer loop advances a checkpoint cursor after an early return on per-item error, any single malformed item becomes a censorship primitive against all sibling items in the same batch range.