# PayGasFeeInZetaAndUpdateCctx() is prone to slippage, causing sender overpays the revert gas and lose returned funds

ZetaChain's gas payment swaps ZETA for gas tokens via UniswapV2 with no slippage check, letting pool manipulation overcharge senders or abort reverts and forfeit refunds.

- Payout: Contest reward
- Severity: medium
- Program: ZetaChain
- Credited: oakcobalt
- Disclosed: 2024-09-06
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-11-zetachain-findings/issues/507
- Library page: https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-06
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm technique:source-review vuln:business-logic vuln:fee-bypass vuln:oracle-manipulation

**Target:** crosschain keeper gas_payment.go UniswapV2 swap flow
**Root cause:** QueryUniswapV2RouterGetZetaAmountsIn quotes the ZETA input needed but the subsequent CallUniswapV2RouterSwapExactETHForToken executes with no min/max slippage bound, so any inflated quote is accepted.
**Steps:**
1. Initiate an outbound or revert cctx with CoinType=Zeta so PayGasInZetaAndUpdateCctx runs.
2. Manipulate the wzeta/gasZRC20 UniswapV2 pool to inflate gasZRC20 price in ZETA before the call.
3. QueryUniswapV2RouterGetZetaAmountsIn returns inflated outTxGasFeeInZeta.
4. feeInZeta = protocolFee + outTxGasFeeInZeta; if feeInZeta > zetaBurnt the tx errors and a revert cctx aborts, losing refunds.
5. Otherwise zetaBurnt.Sub(feeInZeta) overcharges the sender and the swap executes at the inflated quote.
**How found:** Code review of the gas payment flow: noticed the quote from QueryUniswapV2RouterGetZetaAmountsIn is passed directly to the swap with no slippage parameter, and traced the two outcomes (feeInZeta > zetaBurnt abort, or overcharge).
**Exploitation:** Attacker manipulates the wzeta/gasZRC20 pool so the protocol's gas quote is inflated; the protocol then swaps at that price, overcharging the sender or aborting the revert cctx so the sender loses all refunds.
**Insight:** In protocol-owned AMM swaps, check whether the quoted amount is bounded before execution; a quote-then-swap with no min-out/max-in is a value leak, and on revert paths an over-quote can abort the refund entirely.