# Minievm fails to charge intrinsic gas costs for EVM transactions, allowing the abuse of the accesslist to consume computational resources without proper compensation

Minievm skipped intrinsic gas for EVM txs, so access-list entries cost ~300 gas via tx-size instead of 2600, enabling cheap resource-exhaustion DoS.

- Payout: Contest reward
- Severity: high
- Program: Initia
- Credited: berndartmueller
- Disclosed: 2025-04-10
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2025-02-initia-cosmos#h-05
- Library page: https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-05
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:dos vuln:misconfiguration

**Target:** Cosmos SDK EVM module (x/evm keeper context call/create/staticcall)
**Root cause:** EVMCallWithTracer, EVMStaticCallWithTracer and EVMCreateWithTracer never charge intrinsic transaction gas, so EIP-2930 access-list cold-access costs (2600/2100) are never paid upfront while warm-access discounts still apply.
**Steps:**
1. Inspect x/evm/keeper/context.go EVMCallWithTracer/EVMCreateWithTracer/StaticCallWithTracer: no intrinsic gas deduction.
2. Note statedb.go claims EIP-2930 access-list support, so warm/cold logic applies.
3. Submit a tx with a large access list of distinct addresses; each entry costs ~30 bytes * 10 gas = 300 via ConsumeTxSizeGasDecorator.
4. Each entry would otherwise cost 2600 intrinsic gas; the 2300 gap per entry is unpaid.
5. Access list is iterated on-chain uncapped, consuming storage-load compute for free.
**How found:** Compared minievm's call/create paths against Evmos (which charges intrinsic gas) and against EIP-2930 semantics; noticed warm-access discounts applied without the corresponding upfront intrinsic charge, then quantified the tx-size gas vs intrinsic gas gap.
**Exploitation:** Attacker floods transactions with large access lists of distinct contract addresses; each entry is charged only ~300 gas by tx-size decorator instead of 2600 intrinsic, and the on-chain iteration loads code/SLOAD state without compensation, exhausting node compute cheaply.
**Escalation:** Scaling the number of access-list entries per tx widens the 2300-gas gap per entry, amplifying the DoS.
**Insight:** When auditing EVM ports, check that intrinsic gas (including access-list costs) is deducted before execution; warm/cold discount logic assumes it was paid, so a missing deduction turns access lists into a cheap compute amplifier.