Submitted by berndartmueller (1, 2), also found by QiuhaoLi
https://github.com/code-423n4/2023-11-zetachain/blob/b237708ed5e86f12c4bddabddfd42f001e81941a/repos/node/zetaclient/evm_client.go#L859 
https://github.com/code-423n4/2023-11-zetachain/blob/b237708ed5e86f12c4bddabddfd42f001e81941a/repos/node/zetaclient/evm_client.go#L901
An attacker can send an inbound ERC-20 deposit or Zeta transaction with a message exceeding the maximum length limit and causing all other subsequent inbound transactions that occur in the same block range (i.e., startBlock to toBlock) to be ignored by the observers.
ZetaChain observers watch external EVM chains via the ExternalChainWatcher function that internally calls the observeInTX function on each ob.GetCoreParams().InTxTicker ticker.
The observeInTX function performs multiple tasks:
The queried blocks are bound by the range of startBlock and toBlock, which are set in lines 809-810. The startBlock is the previously processed toBlock (i.e., retrieved via ob.GetLastBlockHeightScanned()), incremented by 1.
At the end of the function, in line 988, the toBlock is set as the new lastBlockHeightScanned.
However, if calling PostSend in lines 856 and 898 errors, the for loop is exited early via the subsequent return statement.
Consequently, the observeInTX function proceeds to store the toBlock as the new lastBlockHeightScanned, even though the blocks (and their logs) have not been fully processed.
An attacker can exploit this issue with an inbound transaction that has a message exceeding the maximum length of MaxMessageLength = 10240. This upper bound on the message length is enforced in the MsgVoteOnObservedInboundTx messages ValidateBasic function and prevents observers from sending such a message to ZetaChain as well as also preventing any further processing of the message in case it reaches ZetaChain.
Specifically, both the ERC20Custody.deposit and the ZetaConnectorEth.send function allow specifying an arbitrary message.
Consider only skipping the invalid event and continue processing the remaining events to ensure all events are processed and voted upon.
lumtis (ZetaChain) confirmed
