ZetaChain — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for ZetaChain, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 25
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 25 closed, publicly disclosed ZetaChain reports indexed on CoinBuggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, Bridge exploit, Front-running / MEV, across Cosmos-SDK, EVM-Solidity, Other. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against ZetaChain
- Bridge exploit findings disclosed against ZetaChain
- Front-running / MEV findings disclosed against ZetaChain
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
ZetaChain: `AddToInTxTracker` doens't allow permissionless tx validation for Bitcoin chain, InTxTracker permissionless tx validation for Bitcoin chain will always fail
ZetaChain's permissionless inbound-transaction validation is broken for Bitcoin. The AddToInTxTracker keeper handler only branches on IsEVMChain, so any MsgAddToInTxTracker carrying a Bitcoin chain ID falls through to an unconditional error and always reverts, whereas the equivalent AddToOutTxTracker correctly branches on IsBitcoinChain and supports both chains. This makes the documented permissionless InTx validation feature unusable on Bitcoin, forcing users into the permissioned flow. The sponsor confirmed Bitcoin should be added, and the judge finalized the finding at Medium severity.
ZetaChain: `AddBlockHeader` Cannot Cope with Reorgs
ZetaChain's observer module records block headers of connected external chains after a configured number of confirmations, and its AddBlockHeader message server rejects any header whose height is not exactly LatestHeight+1. When Bitcoin, Ethereum or BSC undergo a reorg deeper than those confirmation counts, observers cannot correct the stored headers: the RemoveBlockHeader keeper exists in the codebase but is never wired into a message server, and voting in a replacement header at an earlier height is blocked by the height check. The finding was upheld as Medium by the judge, who agreed the permissionless-proof architecture breaks when larger reorgs occur, halting trust-less proof verification and extension of consensus about the affected chain.
ZetaChain: Inbound transactions submitted to the `InTxTracker` that contain multiple `ZetaSent` and `Deposited` events are not processed correctly by the observers resulting in a loss of funds
ZetaChain's observer software stops iterating over a transaction receipt's logs as soon as the first ZetaSent (or ERC-20 Deposited) event yields a valid vote message, because of a break statement in the CheckReceiptForCoinTypeZeta and CheckReceiptForCoinTypeERC20 functions. Any inbound transaction can legitimately contain multiple such events when a cross-chain onZetaMessage handler routes to multiple sends or a custody deposit loop fires repeatedly, but only the first event is voted on and forwarded to ZetaChain. When observers have already missed the transaction (why it was submitted to the InTxTracker), the additional events go unprocessed and the corresponding locked/burned Zeta or deposited ERC-20 tokens are at risk of being lost. The proposed fix is to remove the break statements so every matching event in the receipt is voted upon.
ZetaChain: Lagging median gas price when the set of observers changes
ZetaChain relies on a set of observer nodes (zetaclients) who periodically vote on the gas prices of external chains. The crosschain keeper collects every vote into a persistent Prices array and derives the effective outbound gas price as the median of all stored entries. Because a departed observer's last vote is never evicted, the median can be dragged by stale values once the active observer set shrinks — for instance after validators exit, are slashed, or are removed by the admin. The reporter's worked example shows the median staying low (40) while live votes reflect a much higher market price (70), causing outbound cross-chain transactions to be underpriced, linger in the mempool, and let users underpay gas. The protocol maintainer confirmed the finding and recommended discarding stale votes based on the block height recorded alongside each vote.
ZetaChain: Arbitrary destination gas limit for `CoinType_Zeta` cctxs results in paying lower gas fees
ZetaChain's outbound cross-chain flow lets a Zeta-token (CoinType_Zeta) sender specify an arbitrary outbound gas limit that is reused for both fee deduction and the receiver-chain transaction. Unlike CoinType_Gas and CoinType_ERC20 cctxs, which get a hardcoded gas-limit overwrite when fees are paid, Zeta cctxs keep the sender's raw value. A sender can therefore set the limit to a near-zero value so the deducted token fee is almost nothing, while the observers clamp the executed transaction up to a 100k lower bound when signing, leaving the TSS address to cover the real gas cost. The fixed protocol fee only partially offsets this shortfall.
ZetaChain: Zeta Supply Inflation on Deploy Fungible Gas Coin
ZetaChain maintains a core invariant that total ZETA supply must remain constant across all chains, with Ethereum as the home supply location and a supply checker in the zetaclient enforcing compliance. This report shows that invariant breaks in the Cosmos-SDK node: when an admin deploys a gas-token ZRC20 via DeployFungibleCoinZRC20, the SetupChainGasCoinAndPool path calls MintCoins() on the bankkeeper, minting new ZETA supply without a corresponding burn anywhere. This both inflates the ZETA supply and creates ZRC20 tokens that may not be backed by assets in the TSS. The action is admin-gated to new chain creation, so the exploit is limited to privileged actors, but it violates a documented protocol guarantee. The reporter recommends sourcing the needed funds from existing supply (e.g., the community pool) instead of minting from nothing, and a ZetaChain maintainer confirmed the issue.
All reports in this group
- ZetaChain: Direct WETH swap fails due to incompatibility with ``ZetaTokenConsumerUniV3`` & ``ZetaTokenConsumerPancakeV3``Logic error$0
- ZetaChain: Outbound zEVM cross-chain messages ignore the user-specified gas limit and may fail with an out-of-gas errorLogic error$0
- ZetaChain: A single malicious observer can exploit the infinite gas meter to grief ZetaChain blocks without proper gas compensationLogic error$0
- ZetaChain: Observer can halt outbound cctxs and steal fundsLogic error$0
- ZetaChain: An already executed `InTxTracker` can still be addedLogic error$0
- ZetaChain: Inability to reliably verify inbound transactions may result in missed inbound transactionsLogic error$0
- ZetaChain: UpdateSystemContract is not copying `gasPriceByChainId` state variable to the new upgraded which will halt ZRC20 token withdraw until system contract is updated accordinglyLogic error$0
- ZetaChain: ERC-20 deposit cctxs are refunded to the EOA instead of an intermediary contractLogic error$0
- ZetaChain: Inbound Tx Confirmation Bypass via Malicious ObserverLogic error$0
- ZetaChain: Incorrect genesis initialization of pending noncesLogic error$0
- ZetaChain: The outbound transaction tracker only keeps track of a maximum of two different transaction hashes, preventing cctxs from being efficiently confirmed and blocking the outbound transaction queueLogic error$0
- ZetaChain: The `Sender` of an outbound cctx originating from the zEVM is potentially set to an incorrect sender address resulting in lost assets during a refundLogic error$0
- ZetaChain: A single malicious observer can fill the block space with `MsgGasPriceVoter` messages without proper gas compensation resulting in griefing blocksLogic error$0
- ZetaChain: ZRC20 Token Pause Check BypassLogic error$0
- ZetaChain: Gas Coin Setup Result In Immediate Profitable ArbitrageFront-running / MEV$0
- ZetaChain: Zeta token supply checker incorrectly classifies in-transit cctxs as settled resulting in misleading checksLogic error$0
- ZetaChain: Limited Voting Options Allow Ballot Creation SpamLogic error$0
- ZetaChain: JSON-RPC DoS through WebsocketsLogic error$0
- ZetaChain: `PayGasFeeInZetaAndUpdateCctx()` is prone to slippage, causing sender overpays the revert gas and lose returned fundsLogic error$0