# Outbound transactions that can not be broadcasted to an external EVM chain cause a Denial of Service of all outgoing transactions to this chain

Crafting a Zeta cross-chain message whose intrinsic gas exceeds the 100k outbound gas limit makes observers' broadcasts fail, permanently blocking the nonce and halting all outbound txs to that chain.

- Payout: Contest reward
- Severity: high
- Program: ZetaChain
- Credited: berndartmueller
- Disclosed: 2024-09-06
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2023-11-zetachain-findings/issues/412
- Library page: https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AH-07
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** zetaclient EVM outbound signer / ZetaConnector.send
**Root cause:** Outbound tx gas limit is user-controlled and lower-bounded at 100k, but message data can require ~144k intrinsic gas; the RPC rejects the tx and HandleBroadcastError treats it as retryable, so the nonce never advances.
**Steps:**
1. Deploy contract calling `ZetaConnector.send` with `input.message` of 7680 non-zero bytes (base64-encoded to stay under MaxMessageLength=10240) and `gasLimit=100_000`.
2. Call `send(4e18, 100_000)`; ZetaSent event observed by validators.
3. cctx finalized and queued as outbound to chain B.
4. Observers sign and broadcast; RPC returns `intrinsic gas too low` (needs ~144k vs 100k).
5. HandleBroadcastError returns retry=true; after 5 retries loop exits, next ticker retries same nonce forever.
6. Subsequent outbound txs to chain B cannot be sent due to sequential nonce gap.
**How found:** Reasoned that EVM txpool rejects txs whose gas limit is below intrinsic gas (21k + 16/byte), then noticed Zeta's outbound gas limit is attacker-specified with only a 100k floor while message length allows ~144k intrinsic cost, and that HandleBroadcastError only handles specific RPC errors, leaving this one in an infinite retry loop.
**Exploitation:** Attacker sends a single cross-chain message with max-length non-zero payload and minimum gas limit; observers repeatedly fail to broadcast, permanently stalling the outbound nonce for that destination chain until manual validator intervention.
**Insight:** When a bridge lets the sender pick destination gas but derives tx size from attacker data, compare worst-case intrinsic gas (21k + 16*bytes, plus base64 expansion) against the enforced minimum gas floor; also check whether the broadcaster's error handler classifies deterministic validation errors as retryable, since a single unretryable-but-retried tx wedges the sequential nonce.