# DoS of _fillOrder when the Order.receiver is a contract that cannot accept native tokens transfers

Attacker sends 1 wei to GeniusProxyCall so the native-token refund to a non-ETH-receiving Order.receiver reverts, DoSing _fillOrder fulfillment.

- Payout: Contest reward
- Severity: medium
- Program: Genius
- Credited: funkornaut
- Disclosed: 2025-09-04
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_genius_jul2025.pdf#3.2.2
- Library page: https://bugbountylibrary.com/r/cantina%3Agenius_jul2025%3A3.2.2
- Tags: domain:web3 impact:dos kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** GeniusProxyCall.call native token refund path
**Root cause:** GeniusProxyCall unconditionally refunds leftover native balance to Order.receiver and reverts if the transfer fails; no guard prevents receivers that reject ETH or stray balances.
**Steps:**
1. Deploy/identify an Order whose receiver is a contract that rejects native ETH (no receive/fallback).
2. Attacker front-runs fulfillment by sending 1 wei to GeniusProxyCall, leaving a nonzero nativeBalance.
3. Orchestrator calls _fillOrder; GeniusProxyCall.call executes and hits `receiver.call{value: nativeBalance}("")`.
4. Refund to non-payable receiver fails, `revert GeniusErrors.ExternalCallFailed(receiver)` aborts the whole fill.
5. Repeat each attempt to persistently block the order.
**How found:** Code review of the refund block in GeniusProxyCall.sol#L141-L148; noted the assumption that the proxy holds zero native balance after each call and that nothing prevents a non-payable receiver, then hypothesized a stray 1 wei forces the refund path to revert.
**Exploitation:** Cheap front-run: send 1 wei to GeniusProxyCall before the orchestrator's fulfillment tx; the forced refund to a non-ETH-accepting receiver reverts, halting legitimate order execution.
**Insight:** When a contract assumes its own native balance is always zero after execution, look for any external party able to donate dust (selfdestruct, plain transfer) that turns a conditional refund into a revert path.