# Explicit gas limit on low-level Solidity calls can be bypassed by dispatched EVM calls via the custom Cosmos precompile

Initia's Cosmos precompile dispatches MsgCall reusing the parent gas meter, letting a contract called with 100k gas execute nested EVM calls with the full 1M parent limit.

- Payout: Contest reward
- Severity: high
- Program: Initia
- Credited: berndartmueller
- Disclosed: 2025-04-10
- Write-up quality: 8/10
- Original: https://code4rena.com/reports/2025-02-initia-cosmos#h-06
- Library page: https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-06
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic

**Target:** minievm Cosmos precompile (0xf1) / dispatchMessage handler
**Root cause:** dispatchMessage() executes dispatched Cosmos messages (and the defer callback) using the parent call's gas meter instead of a fresh meter bounded by the caller-supplied gas limit, so nested EVM MsgCall runs with the root gas budget.
**Steps:**
1. Deploy an untrusted child contract whose foo() calls COSMOS_CONTRACT.execute_cosmos with a MsgCall targeting itself (nested()).
2. From a parent contract, invoke child.foo() via `address(child).call{gas: 100_000}(...)`.
3. The precompile dispatches MsgCall; dispatchMessage runs handler with the parent's 1M gas meter.
4. nested() executes and emits gasleft() ≈ 919_013, far above the 100k limit.
5. Assert gasReceived > 100_000 in Test_CallChildContractBypassingGasLimit.
**How found:** Code review of dispatchMessage() in context.go noting no new local gas meter is created for the handler or the defer callback, then hypothesizing a low-level call with explicit gas could be escaped via the Cosmos precompile and confirming with a PoC test.
**Exploitation:** A contract that a caller intentionally invokes with a restricted gas budget (e.g. untrusted external call at 100k) routes through the COSMOS_CONTRACT precompile to schedule a MsgCall; the dispatched EVM call executes under the root transaction's full gas meter, consuming far more gas than the caller authorized.
**Insight:** When a chain bridges EVM and Cosmos execution, check whether dispatched messages and defer callbacks inherit the parent gas meter; any cross-VM dispatch path is a candidate for escaping caller-imposed gas limits.