# Observer can halt outbound cctxs and steal funds

ZetaChain observers can submit unverified inbound/outbound tx tracker messages, letting one malicious observer forge deposits, drain funds, or halt cross-chain transactions.

- Payout: Contest reward
- Severity: medium
- Program: ZetaChain
- Credited: berndartmueller
- Disclosed: 2024-09-06
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-11-zetachain-findings/issues/404
- Library page: https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-15
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:go technique:source-review vuln:access-control vuln:business-logic

**Target:** Cosmos SDK crosschain module message handlers (MsgAddToInTxTracker, MsgAddToOutTxTracker, MsgNonceVoter)
**Root cause:** MsgAddToInTxTracker and MsgAddToOutTxTracker accept observer-submitted transactions without Merkle proof verification, and MsgNonceVoter lets a single observer set external chain nonces.
**Steps:**
1. As an observer, submit `MsgAddToInTxTracker` with a non-existent tx hash; zetaclient errors in `ObserveTrackerSuggestions` and stops processing the tracker loop.
2. Submit `MsgAddToInTxTracker` with a tx whose `tx.To` is not a desired contract; zetaclients vote on the fake tx and can forge `Deposit` or `ZetaSent` events.
3. Use forged events to drain funds from the protocol.
4. Alternatively, submit `MsgNonceVoter` to set a mismatched external chain nonce, halting outbound cctxs.
**How found:** Code review of the crosschain keeper message handlers revealed that tracker messages lack Merkle proof verification, and tracing zetaclient processing showed error paths and fake event voting.
**Exploitation:** A single malicious observer submits crafted tracker or nonce-voter messages; zetaclients process them without proof, causing forged deposit events that can be used to drain funds, or nonce mismatches that halt outbound cross-chain transactions.
**Escalation:** Combined with the separate MsgGasPriceVoter griefing issue, a single observer can impact the whole ZetaChain network beyond cctxs.
**Insight:** In cross-chain observer designs, check whether tracker/vote messages require cryptographic proof; a single unverified message from one observer can poison client state or halt processing.