# Fee metering skipped on alternate paths

Paths that settle value or state while skipping gas/fee metering, extension options, or minimum limits

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; one confirmed bounty: $40,000; latest 2025-04-10. Updated 2026-10-23._

## How it works
A transaction or call path reaches settlement without passing through the code that meters and charges for resources. The assumption that breaks is "every path that executes work also pays for it." When a second entry path (a raw SDK message, a dispatched precompile call, a zero-limit deposit) bypasses the metering step, the work still happens but the charge does not. The gap is usually an early return, a missing extension option, or an absent minimum check, not a math error.

## Where it shows up
- Keeper error paths that return early before adding used gas to the meter, especially special-cased non-OOG errors [E1](https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-07.md)
- Nested or dispatched calls (precompile, internal dispatch) that do not pre-charge gas before execution [E1](https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-07.md)
- Dual-runtime chains where the RPC path attaches metadata/extension options that gate fee antehandlers, but the raw message path does not [E2](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-cronos-theft-of-transactions-fees-bugfix-review.md)
- Deposit or bridge functions with no minimum gas limit, so user-supplied zero skips resource accounting [E3](https://bugbountylibrary.com/r/sherlock%3A2023-01-optimism%3AM-11.md)
- Refund or mint logic that pays out or credits value even when execution failed or was never charged [E2](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-cronos-theft-of-transactions-fees-bugfix-review.md)[E3](https://bugbountylibrary.com/r/sherlock%3A2023-01-optimism%3AM-11.md)

## How to review
For every path that executes state changes or moves value, trace whether it passes through the fee/gas metering step before settlement. The invariant: any path that consumes resources must either pre-charge or record the charge, and no error return may exit before the meter is updated. Compare entry paths (RPC vs raw message, direct vs dispatched) and confirm each enforces the same antehandlers and extension options. Check that refunds and mints are conditional on the charge having occurred.

## Variants seen
- Early return on non-OOG error skips gas accounting; dispatched calls run free [E1](https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-07.md)
- Missing extension option skips the gas-consumption antehandler while refund still pays [E2](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-cronos-theft-of-transactions-fees-bugfix-review.md)
- Zero gas limit bypasses resource metering yet value is still minted on failure [E3](https://bugbountylibrary.com/r/sherlock%3A2023-01-optimism%3AM-11.md)

## Impact and severity
Led to chain-level DoS via free calls [E1](https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-07.md), theft of transaction fees [E2](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-cronos-theft-of-transactions-fees-bugfix-review.md), and gasless bridging that bypasses metering [E3](https://bugbountylibrary.com/r/sherlock%3A2023-01-optimism%3AM-11.md). Severity is high where the uncharged path is reachable by any user and repeatable; worse when settlement (refund or mint) still occurs on failure.

## Why fixes fail
Evidence does not show incomplete or regressed fixes.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-07.md
- E2: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-cronos-theft-of-transactions-fees-bugfix-review.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-01-optimism%3AM-11.md