# Block policy discounts gas price by incorrectly applying EIP-1559 to legacy transactions

Monad block policy applied EIP-1559 base-fee ceiling to legacy transactions, underestimating gas cost and letting underfunded txs poison blocks or bypass fees.

- Payout: Contest reward
- Severity: high
- Program: Monad
- Credited: RadiantLabs
- Disclosed: 2026-02-26
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2025-09-monad#h-01
- Library page: https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AH-01
- Tags: domain:web3 impact:dos impact:integrity kind:contest platform:code4rena sev:high tech:rust technique:source-review vuln:accounting-error vuln:dos vuln:fee-bypass

**Target:** bft/monad-eth-block-policy compute_txn_max_gas_cost
**Root cause:** compute_txn_max_gas_cost applies min(max_fee, base_fee+priority_fee) to all tx types, but legacy txs should use gas_price directly; execution layer excludes legacy from the EIP-1559 ceiling, causing consensus/execution divergence.
**Steps:**
1. Read compute_txn_max_gas_cost in bft/monad-eth-block-policy/src/lib.rs L77-84.
2. Note gas_bid = max_fee.min(base_fee+priority_fee) applied unconditionally.
3. Compare to execution transaction_gas.cpp priority_fee_per_gas which returns max_fee-base_fee for legacy txs.
4. Craft a legacy tx with gas_price above base_fee but balance only covering the discounted cost.
5. Block policy accepts it; execution marks it invalid, invalidating the block.
**How found:** Code-reading comparison of consensus block-policy gas cost logic against execution-layer EIP-1559 handling, spotting the missing legacy-tx branch.
**Exploitation:** Attacker submits legacy transactions whose gas_price exceeds base_fee but whose balance only covers the discounted worst-case cost computed by consensus. Block policy includes them; execution rejects them as invalid, invalidating the whole block (DoS). Alternatively, spam many such txs to consume block space without paying full fees.
**Escalation:** Mass submission of underfunded legacy txs to repeatedly poison blocks or bypass gas economic barrier at scale.
**Insight:** When consensus and execution independently compute tx validity, diff their gas/fee formulas per tx type; legacy vs EIP-1559/4844/7702 branches are a common divergence point that yields block-invalidation DoS.