Submitted by berndartmueller
skip-mevs feemarket ante handler escrows the full paid fee amount (which includes the base gas fee + tip). Any paid gas fee that is not consumed is fully refunded to the fee payer in Mantras xfeemarket post handler.
This is problematic in two ways:
skip-mevs feemarket feeMarketCheckDecorator() ante handler decorator escrows the full paid fee amount.
The transactions priority is determined via the priorityFee by converting the full paid fee amount (in any of the allowed coins) to the base denom fee coin (uom). This priorityFee is then used to set the transaction priority within the mempool.
In the post handler, after the message is executed, BurnFeeAndRefund() refunds the tip, i.e., the difference between the gas consumed and the paid fee, to the fee payer.
Knowing that the tip is subsequently refunded, a user might exploit this by providing a large amount of fees to (1) DoS the network by filling up blocks with transactions that consume only a small fraction of the gas limit, and (2) always have a very high priority in the mempool.
Proof of concept:
Here is a PoC that demonstrates how a transaction can set its gas limit as high as the block gas limit to consume all of the block gas and effectively DoS the network:
Two simple bank coin send transactions are generated and broadcasted. The first transaction sets the gas limit to the maximum block gas limit of 75M, and the second transaction sets it to a more reasonable 1M. Both transactions are signed and broadcasted quickly to attempt to get them into the same block.
But, since the first transaction consumes all of the block gas, the second transaction is put into a separate block.
Setup environment by starting a local node:
First, adapt the Makefile to ensure the validator has more available funds and the gas limit is set to 75M (mimicking Mantra mainnet):
Start the local node with:
Next, save the following script as test.sh:
Run with chmod +x test.sh and ./test.sh
The output is as follows:
It shows that both transactions are put into separate blocks, due to the first transaction consuming all of the block gas. And, the first transaction gets a refund of 112410901stake, which is the difference between the gas limit and the gas consumed.
Consider only partially refunding the gas fee tip to the fee payer. This would disincentivize users from overpaying the gas fee.
This has also been suggested as one of the mitigations by Celestia.
Note: this finding was redacted upon submission and was populated by C4 staff to proceed through the audit process.
Lance Lan (MANTRA) confirmed
3docSec (judge) commented:
