# Attacker can send malicious EIP-7702 transactions that cause rounds to time out and halt the chain

Mempool and block validation check EIP-7702 authorization fields in opposite order, letting a crafted tx pass mempool but invalidate blocks, halting the chain.

- Payout: Contest reward
- Severity: high
- Program: Monad
- Credited: TheSchnilch
- Disclosed: 2026-02-26
- Write-up quality: 8/10
- Original: https://code4rena.com/reports/2025-09-monad#h-02
- Library page: https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AH-02
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm technique:source-review vuln:business-logic vuln:dos

**Target:** Ethereum transaction pool and block validator (EIP-7702 authorization handling)
**Root cause:** Mempool validation checks authorization chain_id before the SYSTEM_SENDER_ETH_ADDRESS check, while block validation checks SYSTEM_SENDER_ETH_ADDRESS first. A tx with authority=SYSTEM_SENDER_ETH_ADDRESS and invalid chain_id passes mempool but fails block validation.
**Steps:**
1. Craft EIP-7702 tx with authorization authority set to `SYSTEM_SENDER_ETH_ADDRESS` and an invalid `chain_id`.
2. Submit to mempool: chain_id check fails first, SYSTEM_SENDER check skipped, tx accepted.
3. Leader includes tx in block; block validation runs SYSTEM_SENDER check first, fails, block deemed invalid.
4. Block never added to block tree, `try_vote` never called, round times out.
5. Resend to next scheduled leaders (schedule is public) repeatedly; tx never executes so resubmission is free.
**How found:** Code review comparing the ordering of checks between mempool transaction validation and block validation for EIP-7702 authorizations; noticed the SYSTEM_SENDER_ETH_ADDRESS vs chain_id check order was inverted between the two paths.
**Exploitation:** Attacker submits the malformed EIP-7702 tx to nodes/leaders; each leader that includes it produces an invalid block, causing repeated round timeouts. Targeting known future leaders avoids broadcasting to all nodes. Repeating indefinitely halts the chain at no cost since the tx never executes.
**Escalation:** Uses public leader schedule to target only upcoming leaders, minimizing effort while sustaining chain halt indefinitely.
**Insight:** When the same validation logic exists in two places (mempool vs block validation), diff the order and conditions of checks; any asymmetry lets an attacker craft input that passes one and fails the other, turning a validation bug into a liveness/DoS vector.