# EIP-7702 order dependent delegated-status mismatch enables persistent free chain DoS

Order-dependent EIP-7702 delegation mismatch between txpool and block policy lets an attacker craft two txs that make every proposer build invalid blocks, stalling the chain for free.

- Payout: Contest reward
- Severity: high
- Program: Monad
- Credited: oct0pwn
- Disclosed: 2026-02-26
- Write-up quality: 8/10
- Original: https://code4rena.com/reports/2025-09-monad#h-04
- Library page: https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AH-04
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm technique:chained technique:source-review vuln:business-logic vuln:dos

**Target:** EVM L1 txpool proposal sequencing and block policy reserve validation
**Root cause:** Txpool marks an EIP-7702 authority as delegated lazily during proposal assembly (ordering-dependent), while block policy pre-marks all recovered authorities as delegated for the whole block before per-tx reserve checks (ordering-insensitive), reclassifying an admitted emptying tx as non-emptying.
**Steps:**
1. Submit X: EIP-1559 tx, gas ≤30M, value=0, very high tip so gas_at_bid*gas_limit > max_reserve_balance, balance ≥ txn_max_gas.
2. Submit Y: valid EIP-7702 tx with authorization signed by same authority A, slightly lower tip so it orders after X.
3. Txpool admits X first under emptying rules while A not yet delegated, then includes Y and flips A to delegated.
4. Block policy collects A from whole block up-front, pre-marks delegated, re-evaluates X as non-emptying, fails InsufficientReserveBalance.
5. Block rejected pre-execution; txs remain pooled and re-proposed, repeating across leaders.
**How found:** Code review comparing delegation-state derivation timing between txpool sequencer (lazy, per-tx) and block policy (global pre-marking), spotting the semantic mismatch that reclassifies a tx between admission and consensus validation.
**Exploitation:** Attacker needs only two signed txs (X and Y) targeting the same authority; no capital spent since block rejection occurs pre-execution. Re-proposal of the same pooled txs across successive leaders sustains the DoS, optionally rotating senders.
**Escalation:** Repeat across leader slots and rotate senders to keep the pool poisoned, causing near-complete chain stall and denying finality.
**Insight:** When two components derive the same state flag at different times (lazy per-tx vs global pre-pass), craft txs whose classification flips between them; here an emptying-path tx becomes non-emptying under block policy, yielding free pre-execution rejection.