# A single malicious observer can fill the block space with MsgGasPriceVoter messages without proper gas compensation resulting in griefing blocks

Gas meter reset per MsgGasPriceVoter in ZetaChain lets one observer pack many messages into a tx paying gas for only the last, griefing block space.

- Payout: Contest reward
- Severity: medium
- Program: ZetaChain
- Credited: berndartmueller
- Disclosed: 2024-09-06
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-11-zetachain-findings/issues/398
- Library page: https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-18
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm technique:chained technique:source-review vuln:dos

**Target:** Cosmos SDK crosschain module GasPriceVoter handler
**Root cause:** ResetGasMeterAndConsumeGas refunds all consumed gas and charges only the last message's EVM gas, ignoring accumulated gas across multiple messages in one Cosmos tx.
**Steps:**
1. Start local env via `make start-smoke-test`
2. Get observer address via `zetacored keys show operator`
3. Generate tx JSON with N `MsgGasPriceVoter` messages via script `./gas.sh 100 OBSERVER_ADDRESS`
4. Sign: `zetacored tx sign gas.json --from OBSERVER_ADDRESS --gas=auto --gas-prices=0.4azeta --gas-adjustment=20 --chain-id=athens_101-1 --keyring-backend=test -y --broadcast-mode=block > tx.signed.json`
5. Broadcast: `zetacored tx broadcast tx.signed.json`
6. Query `zetacored q tx --type=hash HASH | grep gas_used` shows ~28704 gas despite 100 messages
**How found:** Code review of GasPriceVoter handler noticed ResetGasMeterAndConsumeGas called per message, unlike Evmos which uses accumulated gas across messages; verified with multi-message tx PoC.
**Exploitation:** A malicious observer bundles many MsgGasPriceVoter messages in one tx; gas meter reset per message means only the last message's gas is charged, so cheaply filling blocks and starving other transactions.
**Insight:** When a handler resets the Cosmos gas meter to match EVM gas, check whether it uses accumulated vs per-message gas—multi-msg txs can bypass gas accounting entirely.