# Distribution module address can be used to halt chain breaking all functionality.

Any user could send tokens to the Cosmos distribution module account, breaking the crisis invariant and halting the ZetaChain chain entirely.

- Payout: Contest reward
- Severity: medium
- Program: ZetaChain
- Credited: jayjonah8
- Disclosed: 2024-09-06
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-11-zetachain-findings/issues/176
- Library page: https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-33
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:go technique:source-review vuln:business-logic vuln:dos

**Target:** Cosmos SDK bank module / distribution module account
**Root cause:** The distribution module account was not added to the x/bank blocked-address map, so arbitrary users could send funds to it, violating the crisis invariant that module accounts only receive funds via expected state-machine paths.
**Steps:**
1. Build zetacored and init localnet with `--inv-check-period 2` in run.sh
2. Start chain via `make run`
3. Query module accounts: `zetacored q auth accounts` to get distribution address `zeta1jv65s3grqf6v6jl3dp4t6c9t9rk99cd83m2fn0`
4. Send funds: `zetacored tx bank send zeta13c7p3xrhd6q2rx3h235jpt8pjdwvacyw6twpax zeta1jv65s3grqf6v6jl3dp4t6c9t9rk99cd83m2fn0 100azeta --gas-prices 20azeta`
5. Observe consensus failure and chain halt; no new blocks produced
**How found:** Researcher reviewed Cosmos module account handling and noticed the distribution module account was not blocklisted in x/bank, then tested a direct transfer to confirm the invariant break.
**Exploitation:** Attacker with any funded account sends a trivial bank transfer to the distribution module address; the invariant check fails and consensus halts, stopping block production.
**Insight:** On Cosmos chains, enumerate module accounts and check each against the bank module's blocked-address map; any module account accepting arbitrary transfers can break invariants and halt the chain.