# L2 hooks don’t execute ValidateBasic on provided messages

Initia L2 bridge hooks execute Cosmos messages without ValidateBasic, letting depositors run messages that bypass validation, risking inconsistent state or panics.

- Payout: Contest reward
- Severity: medium
- Program: Initia
- Credited: RadiantLabs
- Disclosed: 2025-04-10
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-01-initia-rollup-modules#m-05
- Library page: https://bugbountylibrary.com/r/c4%3A2025-01-initia-rollup-modules%3AM-05
- Tags: domain:web3 impact:dos impact:integrity kind:contest platform:code4rena sev:medium tech:evm technique:incomplete-fix technique:source-review vuln:access-control vuln:business-logic

**Target:** L1 deposit bridge hook message execution (deposit.go)
**Root cause:** The hook message loop calls the router handler directly without invoking validateBasicTxMsgs, and the OPinit ante handler omits NewValidateBasicDecorator, so messages bypass ValidateBasic checks that RPC-submitted txs enforce.
**Steps:**
1. Compare BaseApp.runTx which calls `validateBasicTxMsgs(msgs)` before ante/runMsgs.
2. Inspect deposit.go L54-66: loop over `tx.GetMsgs()` calling `k.router.Handler(msg)` with no ValidateBasic.
3. Inspect ante.go: RPC ante handler includes `ante.NewValidateBasicDecorator()` (L90) but `CreateAnteHandlerForOPinit` (L111-115) omits it.
4. Submit a deposit with a signed payload containing a message whose ValidateBasic would fail; observe it executes via hook.
5. Trigger message-specific invalid state or panic in MsgServer.
**How found:** Code-reading comparison of the L2 hook execution path against BaseApp.runTx and the two ante handler constructors, spotting the missing validateBasicTxMsgs call and missing ValidateBasicDecorator.
**Insight:** When a chain has alternate tx entrypoints (bridge hooks, IBC callbacks, custom ante handlers), diff their message pipeline against BaseApp.runTx — ValidateBasic and ante decorators are commonly dropped on the secondary path.