# Mempool vs block validation mismatch

Same authorization or cost check done in two places; diff order, formulas and derived flags

_Area: Smart contract access control and control flow. Seen in 4 disclosed reports; latest 2026-02-26. Updated 2026-10-23._

## How it works
A transaction is judged twice: once when it enters the mempool, once when a block is built or validated. The two paths are written separately, so they can disagree on what makes a transaction valid. Any input that passes the first gate but fails the second is a wedge: it is cheap to submit, gets accepted, and then makes blocks invalid or unbuildable. The broken assumption is that "admitted" implies "executable".

## Where it shows up
- Two functions that both decide validity: an insert/admission path and a proposal/block-validation path.
- Checks that appear in both but in different order (e.g. chain-id check before a special-address check in one, reversed in the other) [E1](https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AH-02.md).
- Cost or affordability formulas that differ: base fee only at insert vs full gas bid at proposal [E2](https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AH-03.md).
- State flags derived at different times: lazily per transaction vs a global pre-pass over the block [E3](https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AH-04.md).
- The same logical value (base fee) carried in two headers with no equality check between them, or a fallback like `unwrap_or(constant)` masking divergence [E4](https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AM-07.md).

## How to review
Find every place the same transaction property is evaluated. For each pair, compare the exact predicate: same fields, same order, same formula, same timing. The invariant that must hold: for any transaction, admission-time validity and proposal-time validity are identical, and any value used by both consensus and execution is explicitly compared, not defaulted. Also check what happens to a transaction that passes one and fails the other — if it is returned to the pool rather than dropped, it can be resubmitted indefinitely [E2](https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AH-03.md).

## Variants seen
- Order-dependent authorization checks on EIP-7702 fields [E1](https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AH-02.md).
- Affordability gate using base fee only, proposal using full bid [E2](https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AH-03.md).
- Delegated-status flag computed lazily vs pre-marked, flipping classification [E3](https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AH-04.md).
- Missing equality check between consensus and execution base fee [E4](https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AM-07.md).

## Impact and severity
High: cheap, repeatable transactions that stall block building or halt the chain, and in E4 a consensus/execution split where a malicious proposer finalizes a block execution rejects. Severity rises when the mismatched input is free to resend and when it affects every proposer, not just one.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AH-02.md
- E2: https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AH-03.md
- E3: https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AH-04.md
- E4: https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AM-07.md