# EVM stack overflow error leads to no gas being charged, which can be exploited to DoS the chain by dispatching EVM calls via the cosmos precompile

Initia EVM keeper skips gas charging when EVM returns zero gas with non-OOG error, letting CosmosPrecompile-dispatched calls run gas-free and DoS the chain.

- Payout: Contest reward
- Severity: high
- Program: Initia
- Credited: berndartmueller
- Disclosed: 2025-04-10
- Write-up quality: 8/10
- Original: https://code4rena.com/reports/2025-02-initia-cosmos#h-07
- Library page: https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-07
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:accounting-error vuln:dos

**Target:** Cosmos SDK EVM module (minievm) EVMCallWithTracer/EVMCreateWithTracer via CosmosPrecompile
**Root cause:** Early return when gasRemaining==0 && err!=nil && err!=vm.ErrOutOfGas skips adding used EVM gas to the gas meter; dispatched calls via CosmosPrecompile don't pre-charge gas, so the call is entirely free.
**Steps:**
1. Deploy Counter contract with recursive() dispatching an EVM call to nested() with allow_failure=true.
2. nested() calls consumeGas(1_000_000) then triggerStackOverflow() (infinite recursion) to force stack overflow.
3. Call recursive(1) via EVMCall; nested call returns gasRemaining==0 with non-OOG error.
4. Observe ctx.GasMeter() consumed <= 100_000 despite ~1M gas burned in nested call.
5. Repeat dispatched calls to exhaust block gas without paying, DoSing the chain.
**How found:** Code review of EVMCallWithTracer/EVMCreateWithTracer spotted the special-case early return for gasRemaining==0 with non-OOG errors, then reasoned that CosmosPrecompile dispatchMessage doesn't pre-charge gas, making such calls free.
**Exploitation:** Attacker repeatedly invokes a contract that dispatches nested EVM calls via CosmosPrecompile which burn large gas then trigger stack overflow; since no gas is charged, block gas accounting is bypassed and chain throughput can be exhausted for free.
**Escalation:** Repeating the free nested calls scales to chain-wide DoS since block gas meter never reflects actual EVM work.
**Insight:** When auditing EVM-in-Cosmos bridges, check every early-return error path in the keeper for missing gas consumption; nested/dispatched calls that skip upfront gas charging turn any uncharged error path into a free-compute DoS primitive.