# Precompiles fail to charge gas in case of an error leading to a DOS vector

Initia minievm precompiles return early on ABI lookup/unpack errors without charging input gas, letting a loop contract burn 30M gas in ~2s and exceed 500ms block time.

- Payout: Contest reward
- Severity: high
- Program: Initia
- Credited: berndartmueller
- Disclosed: 2025-04-10
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2025-02-initia-cosmos#h-08
- Library page: https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-08
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:go technique:source-review vuln:accounting-error vuln:dos

**Target:** EVM precompiles (jsonutils, cosmos, erc20_registry) ExtendedRun
**Root cause:** Input-length gas is charged only after ABI MethodById and Inputs.Unpack succeed; on error the precompile returns with usedGas=0, so expensive decoding work is free.
**Steps:**
1. Craft bytecode that STATICCALLs precompile 0xf3 with an unknown 4-byte selector (e.g. `63762ECA335F525F5B5F6020601C60F35FFA600856`)
2. Loop the STATICCALL until gas exhausted
3. Execute via EVMCall with 30M gas meter
4. Observe ~2.13s execution time vs 30M gas consumed
**How found:** Code review of ExtendedRun: noticed gas charge at line 93 occurs after MethodById/Unpack which can return early at lines 84/89 without charging; built a loop contract PoC to measure wall-clock vs gas.
**Exploitation:** Attacker deploys a contract looping STATICCALLs to the precompile with an invalid selector; each iteration costs only ~125 gas (warm access) but triggers ABI lookup/unpack work, so a 30M-gas tx runs ~2s, exceeding the 500ms target block time and DoSing the network.
**Insight:** In precompile/EVM glue code, check whether gas is charged before or after fallible parsing; early-return error paths that skip metering let cheap opcodes trigger expensive off-chain work — measure wall-clock per gas, not just gas accounting.