# Limited Voting Options Allow Ballot Creation Spam

ZetaChain observer vote handlers only allow success votes, so a faulty observer can spam unopposable ballots that honest observers must process but cannot slash.

- Payout: Contest reward
- Severity: medium
- Program: ZetaChain
- Credited: ciphermarco ([1](https://github.com/code-423n4/2023-11-zetachain-findings/issues/536)
- Disclosed: 2024-09-06
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-11-zetachain-findings/issues/536
- Library page: https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-05
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:go technique:source-review vuln:business-logic vuln:dos vuln:governance

**Target:** Cosmos SDK observer ballot voting handlers (inbound tx vote, blame vote, block header vote)
**Root cause:** Several vote message handlers hardcode VoteType_SuccessObservation, so no honest observer can cast a failure vote to reach threshold and trigger slashing; in-progress ballots yield zero reward units instead of negative.
**Steps:**
1. Compromised observer submits `MsgVoteOnObservedInboundTx` / `MsgAddBlameVote` / `MsgAddBlockHeader` with fabricated observation; handler calls `AddVoteToBallot(..., VoteType_SuccessObservation)`.
2. Honest observers attempt to vote the opposite but handlers only accept success votes, so ballot never reaches threshold and stays `BallotStatus_BallotInProgress`.
3. At maturity `GetMaturedBallotList` returns the ballot; `BuildRewardsDistribution` returns `totalRewardUnits == 0` for in-progress status, so no slashing occurs.
4. Repeat to spam ballots, consuming honest observer processing resources indefinitely.
**How found:** Code reading of the vote handlers revealed that only `VoteType_SuccessObservation` is passed to `AddVoteToBallot` in three message paths, unlike TSS voter and outbound tx vote handlers which map status to success/failure vote types.
**Exploitation:** A single compromised or faulty observer repeatedly creates ballots with false observations. Honest observers must process each ballot but cannot cast an opposing vote, so the ballot never finalizes and the spammer is never slashed; the spammer drains observer resources at no cost.
**Insight:** When auditing threshold-based voting, check whether every message path can express both vote outcomes; a hardcoded success vote removes the slashing deterrent and turns ballot creation into a free spam primitive.