# The bidder could DOS the bid processing and slashing or force oracle to spend an enormous amount of gas for bid processing

Malicious bidder contract reverts or burns gas on ETH push-transfer, blocking PreconfManager slash/reward settlement and griefing the oracle.

- Payout: Contest reward
- Severity: medium
- Program: Primev
- Credited: sashik-eth
- Disclosed: 2025-08-27
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_primev_oct2024.pdf#3.2.13
- Library page: https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.2.13
- Tags: domain:web3 impact:dos kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** PreconfManager / ProviderRegistry / BidderRegistry settlement ETH transfers
**Root cause:** Settlement uses push ETH transfers via `call` with no gas limit and requires success, so a bidder contract can revert or consume unbounded gas to block slash/reward.
**Steps:**
1. Register a contract address as bidder.
2. Create a legit bid; provider accepts and preconfirms it.
3. Bid is included or excluded from the block.
4. Oracle calls `initiateSlash` or `initiateReward`.
5. Bidder contract reverts on the ETH `call` (or burns enormous gas), blocking settlement.
**How found:** Code review of settlement flow: noticed push `call{value:...}` to bidder with no gas limit and a success require in slash/unlockFunds/retrieveFunds.
**Exploitation:** Attacker-controlled bidder contract reverts in its receive/fallback so `require(success, TransferToBidderFailed)` fails, or consumes huge gas during the call, forcing the oracle's settlement tx to fail or waste gas.
**Insight:** In settlement/refund flows, any push ETH transfer to a user-supplied address with a success require is griefable; check whether bidder/provider addresses can be contracts and whether gas is capped.