# Panic when decoding a malformed deposit transaction JSON string

op-geth UnmarshalJSON dereferences dec.Gas without nil check, so a deposit tx JSON lacking "gas" panics the decoder and crashes ethclient.

- Payout: Contest reward
- Severity: medium
- Program: Optimism
- Credited: shw
- Disclosed: 2023-01-19
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-01-optimism-judging/issues/276
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-optimism%3AM-3
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:go technique:source-review vuln:dos

**Target:** op-geth core/types transaction JSON unmarshalling (DepositTxType)
**Root cause:** In UnmarshalJSON for DepositTxType, dec.Gas is dereferenced at L293 without a nil check; a JSON deposit transaction omitting the "gas" field leaves it nil, causing a nil pointer dereference panic.
**Steps:**
1. Craft deposit tx JSON with type 0x7e and all fields but omit "gas"
2. Call json.Unmarshal into &Transaction{}
3. Observe panic at transaction_marshalling.go L293
4. PoC: add TestDecodeJSON to op-geth/core/types/transaction_test.go and run `cd op-geth && go test -run TestDecodeJSON -v ./core/types`
**How found:** Code review of the newly added DepositTxType branch in UnmarshalJSON, noticing dec.Gas used without nil check unlike other optional fields.
**Exploitation:** A malicious RPC endpoint returns a block via eth_getBlockByHash containing a deposit transaction without the "gas" field; ethclient's getBlock decodes rpcBlock/rpcTransaction and crashes on the nil dereference.
**Insight:** When a new tx type branch is added to JSON marshalling, audit each pointer field dereference against nil — optional JSON fields decode to nil pointers and panic; malicious RPC peers can weaponize client-side decoders.