# Fee market post handler misses to account for gas consumed after taking the gas snapshot, leading to higher refunds and unpaid gas

MANTRA xfeemarket post handler snapshots gas before burn/refund operations, so ~19% of gas is refunded as tip instead of paid by the user.

- Payout: Audit contest
- Severity: medium
- Program: MANTRA
- Credited: berndartmueller
- Disclosed: 2025-03-31
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2024-11-mantra-chain#m-01
- Library page: https://bugbountylibrary.com/r/c4%3A2024-11-mantra-chain%3AM-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:go technique:source-review vuln:accounting-error vuln:fee-bypass

**Target:** Cosmos SDK xfeemarket post handler (x/xfeemarket/post/fee.go)
**Root cause:** CheckTxFee() takes a gas snapshot to compute the refunded tip, but gas consumed afterward by burning fees and the bank refund transfer is not charged to the user, inflating the tip.
**Steps:**
1. Instrument x/xfeemarket/post/fee.go: capture `snapshot := ctx.GasMeter().GasConsumed()` after L117 and print `ctx.GasMeter().GasConsumed() - snapshot` after L141.
2. Add test case in x/xfeemarket/post/fee_test.go with gasLimit=100000, validFee = DefaultMinBaseGasPrice*100000, RunAnte/RunPost true.
3. Run test; observe `gasDiff 28909` gas consumed after the snapshot that is not paid by the user.
4. Compare to a real bank send tx consuming ~151517 gas: 28909/151517 ≈ 19% gas leakage.
**How found:** Warden read the post handler and noticed the gas snapshot at L99 was used for refund calculation, hypothesizing later gas-consuming operations (burn, bank send) were uncharged; judge initially disputed, warden added instrumentation PoC showing 28909 gas diff.
**Exploitation:** A user submits transactions with a tip; the post handler refunds a tip computed from a gas snapshot taken before burn and refund bank send, so the user underpays gas by the post-snapshot consumption, repeatedly leaking fees.
**Insight:** In Cosmos SDK post/ante handlers, any gas consumed after the refund/tip snapshot (state writes, bank sends, burns) is silently refunded to the user; instrument GasConsumed() deltas around the snapshot to quantify leakage.