# A single malicious observer can exploit the infinite gas meter to grief ZetaChain blocks without proper gas compensation

ZetaChain ante handler grants infinite gas meter if any message is a gas-price-voter, letting one observer bundle costly messages and grief block space.

- Payout: Contest reward
- Severity: medium
- Program: ZetaChain
- Credited: berndartmueller
- Disclosed: 2024-09-06
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-11-zetachain-findings/issues/410
- Library page: https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-10
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:go technique:source-review vuln:business-logic vuln:dos

**Target:** Cosmos SDK ante handler / transaction gas metering
**Root cause:** NewAnteHandler selects the no-gas-limit ante handler when at least one message is MsgGasPriceVoter or MsgVoteOnObservedInboundTx, applying the infinite gas meter to all bundled messages instead of only those types.
**Steps:**
1. Observe ante.go lines 97-112: loop sets found=true on first matching msg type, then uses newCosmosAnteHandlerNoGasLimit.
2. As an observer, craft a tx containing one MsgGasPriceVoter/MsgVoteOnObservedInboundTx plus many high-gas messages.
3. Set gas price very low; infinite meter means tx never runs out of gas.
4. Submit repeatedly to fill block space up to CometBFT's 10M block gas limit, starving other txs.
**How found:** Code review of the ante handler switch: noticed the loop only requires one matching message to select the no-gas-limit handler, so the infinite meter leaks to all other messages in the tx.
**Exploitation:** A single malicious observer submits transactions bundling a legitimate observer message with many gas-heavy messages under an infinite gas meter, paying negligible fees while consuming block gas and preventing other transactions from being included.
**Insight:** When a privileged message type relaxes gas checks, check whether the relaxation is scoped per-message or per-transaction; bundling lets an attacker smuggle arbitrary gas-heavy work under the exemption.