# Refunding the full gas fee tip allows inflating the transaction priority and filling up the block gas limit, effectively DoSing the network

MANTRA's xfeemarket refunds unspent gas tip, letting attackers set near-block-limit gas, get refunded, and fill blocks to DoS the chain.

- Payout: Audit contest
- Severity: high
- Program: MANTRA
- Found by: berndartmueller
- Disclosed: 2025-03-31
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2024-11-mantra-chain#h-03
- Library page: https://bugbountylibrary.com/r/c4%3A2024-11-mantra-chain%3AH-03
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:go technique:chained technique:source-review vuln:business-logic vuln:dos

**Target:** Cosmos SDK feemarket ante/post handler (skip-mev) on MANTRA chain
**Root cause:** The feemarket ante handler escrows the full paid fee (base+tip) and sets mempool priority from it, but the post handler BurnFeeAndRefund refunds the entire unspent tip, so overpaying costs nothing.
**Steps:**
1. Configure genesis max_gas=75000000 to mimic mainnet.
2. Generate tx1 with `--gas 75000000 --gas-prices 1.5stake` and tx2 with `--gas 1000000`.
3. Sign both offline with consecutive sequences and broadcast back-to-back.
4. Observe tx1 gas_wanted=75000000, gas_used=120980, tip_refund=112410901stake, and tx2 landing in the next block (height diff 1).
**How found:** Code-read the skip-mev feemarket decorator: priority is set from full paid fee (line 156) while BurnFeeAndRefund refunds the tip (lines 164-169), implying overpayment is free; then validated with a local-node PoC.
**Exploitation:** Attacker broadcasts many txs each declaring gas limit near the 75M block cap while consuming ~120k gas; each fills a block's gas meter, pushing legitimate txs to later blocks, while the unused tip is fully refunded so the attack is nearly free. Same overpayment also maximizes mempool priority.
**Escalation:** Repeat across blocks to sustain block-space exhaustion and priority dominance.
**Insight:** In Cosmos feemarket designs, check whether priority is derived from the full escrowed fee while refunds return the unspent tip — that asymmetry makes gas-limit inflation free and turns declared gas into a block-space weapon.