# Using unconfirmed UTXOs as inputs for transactions is vulnerable to griefing attacks

ZetaChain's BTC client counts unconfirmed mempool UTXOs as spendable, letting an attacker grief TSS outbound BTC transactions via low-fee sends and RBF replacement.

- Payout: Contest reward
- Severity: high
- Program: ZetaChain
- Credited: berndartmueller
- Disclosed: 2024-09-06
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-11-zetachain-findings/issues/402
- Library page: https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AH-09
- Tags: domain:web3 impact:dos impact:integrity kind:contest platform:code4rena sev:high tech:solidity technique:race-window technique:source-review vuln:business-logic vuln:dos

**Target:** Bitcoin observer client UTXO fetching (ListUnspentMinMaxAddresses) for TSS address
**Root cause:** FetchUTXOS calls ListUnspentMinMaxAddresses with minConfirmations=0, so unconfirmed mempool outputs to the TSS address are treated as spendable inputs for outbound transactions.
**Steps:**
1. Attacker sends a low-fee BTC tx to the TSS address whose outputs fall in the UTXO range the TSS will spend next.
2. While unconfirmed, observer clients fetch these outputs as UTXOs (minConfirmations=0).
3. TSS builds outbound tx using these unconfirmed inputs; it stays unconfirmed while the attacker's tx is unconfirmed, halting outbound BTC.
4. Attacker uses RBF to replace the original tx, redirecting funds away from TSS, invalidating the TSS inputs and causing the outbound tx to fail.
**How found:** Code review of FetchUTXOS noticed minConfirmations=0 in ListUnspentMinMaxAddresses; compared against Thorchain's implementation which filters unconfirmed UTXOs to self/Asgard sends.
**Exploitation:** Attacker broadcasts a low-fee tx to the TSS address, waits for the client to pick its outputs as inputs, then either withholds confirmation to stall outbound BTC or RBF-replaces the tx to a non-TSS address to invalidate the TSS transaction.
**Escalation:** RBF replacement converts a stall into outright invalidation of the TSS outbound transaction.
**Insight:** When auditing bridge/custody Bitcoin clients, check the minConfirmations argument to ListUnspent and whether mempool outputs from arbitrary senders are accepted as spendable inputs; compare to Thorchain's isSelfTransaction filter.