ZetaChain Cross-Chain — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for ZetaChain Cross-Chain, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 35
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 35 closed, publicly disclosed ZetaChain Cross-Chain reports indexed on CoinBuggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, Bridge exploit, Access control, across Solana-Rust, Other, EVM-Solidity, Cosmos-SDK, Move. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against ZetaChain Cross-Chain
- Bridge exploit findings disclosed against ZetaChain Cross-Chain
- Access control findings disclosed against ZetaChain Cross-Chain
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
ZetaChain Cross-Chain: Solana zetaclient inbound observer is blocked indefinitely when an additional account is passed to the `call` instruction
The Solana gateway program's `call` instruction tolerates extra accounts in the instruction (it only needs one signer), but the Solana zetaclient's `ParseInboundAsCall` parser demands exactly one account via `len(instructionAccounts) != 1`. A single crafted transaction that appends an extra account executes successfully on-chain yet breaks parsing on the zetaclient observer, which re-scans the same failing signature every ticker and thereby stalls processing of all other inbound Solana transactions indefinitely. The protocol fixed the check to require at least one signer (`< 1`) in PR zeta-chain/node#3895.
ZetaChain Cross-Chain: A Malicious Observer can use TON's Outbound Tracker to steal funds from Zetachain
ZetaChain's TON outbound tracker processing never verifies that the nonce of a TON withdrawal transaction matches the nonce of the outbound CCTX being voted on. A malicious Observer can therefore submit a transaction hash for a CCTX whose genuine TON withdrawal already succeeded, pointing instead at an unrelated failed TON transaction. Every Observer then processes the tracker entry and marks the CCTX as failed, so consensus finalizes a revert that refunds the same amount again inside ZetaChain. The attacker keeps the originally withdrawn TON and also receives the refund, permanently draining TON from the bridge by one withdrawal amount per occurrence. The protocol team applied a fix in PR zeta-chain/node#3977.
ZetaChain Cross-Chain: EVM outbound transaction gas limit can be set lower than the intrinsic gas limit, which prevents sending the transaction and blocks all other outbound transactions to this chain
A recent change to ZetaChain's zetaclient signer removed the lower-bound check on the gas limit applied to outbound EVM transactions. Because only a maximum (and a fixed 21k special case) is now enforced, an attacker can craft an outbound CCTX with a very low gas limit such as 1337. When broadcasting to Ethereum, the RPC rejects the transaction with an intrinsic-gas error; since the TSS nonce is never incremented, the CCTX sticks in the outbound queue and all subsequent outbound transactions to that chain are permanently blocked (a non-recoverable DoS). The protocol fixed it by restoring a 100k floor in PR #3848.
ZetaChain Cross-Chain: Removing an observer doesn't update an active ballot's voter list, leading to deadlocks
In ZetaChain's Cosmos-SDK observer module, each ballot takes a static snapshot of the active observer set into its VoterList at creation time, and only those listed observers may vote. When a validator is slashed or its self-delegation falls below the minimum, the cleanup hooks (CleanSlashedValidator/CleanObservers) remove it from the observer set but never prune it from active ballots' voter lists. If enough observers leave mid-ballot, the remaining eligible voters cannot reach the quorum threshold computed against the original list size, leaving the ballot permanently stuck in BallotInProgress. This deadlocks dependent cross-chain functions such as blame handling and inbound/outbound transaction validation. The team acknowledged the finding but stated it would not be fixed at the time of disclosure.
ZetaChain Cross-Chain: Insufficient Transaction Broadcast Timeout in EVM Chains
ZetaChain's EVM transaction signer hardcodes a 1-second context timeout for broadcasting signatures to connected EVM chains. On higher-latency networks such as Arbitrum, the initial SendTransaction call can time out while the transaction is still propagating, and the subsequent retry with the same nonce then fails with "nonce too low." The result is dropped outbound tracker postings and state inconsistency between ZetaChain and the EVM chain, which the reporter notes would require a hard fork to repair. The protocol accepted the finding and fixed it by introducing configurable broadcastTimeout/broadcastRetries constants (PR zeta-chain/node#3850).
ZetaChain Cross-Chain: Jailed validators are able to participate in voting
ZetaChain's observer keeper lets jailed validators keep voting on inbound and outbound observation ballots. While the observer-update path rejects any validator that is jailed or not bonded, the ballot-voting path only checks that the voter is a non-tombstoned observer, so a validator that misbehaved and was jailed (but not yet tombstoned) retains a vote. That lets a disqualified validator keep influencing which cross-chain observations get confirmed. The team fixed it in zeta-chain/node PR 3917 by replacing the tombstone-only check with CheckObserverCanVote, which also enforces the jailed/bonded status.
All reports in this group
- ZetaChain Cross-Chain: removed observers are still able to voteLogic error$0
- ZetaChain Cross-Chain: V1 ZEVM logs incorrectly use the `emittingContract` address as the CCTX `sender` addressLogic error$0
- ZetaChain Cross-Chain: Bitcoin Observers' signed transactions will be rejected due to invalid sighashesLogic error$0
- ZetaChain Cross-Chain: Observer rewards are less than expected due to not properly accounting for negative rewardsLogic error$0
- ZetaChain Cross-Chain: ZETA token supply keeps growing on failed `onReceive()` contract callsLogic error$0
- ZetaChain Cross-Chain: Dirty EVM state changes are not committed before precompile calls, resulting in double-spending or loss of ZETA tokensLogic error$0
- ZetaChain Cross-Chain: Token Mismatch in SPL Token DepositsLogic error$0
- ZetaChain Cross-Chain: Lost funds on ZetaChain due to unprocessed ZEVM logsLogic error$0
- ZetaChain Cross-Chain: Incorrect Formate for transaction building, and transaction executions In Solana will lead to revert all execute Operations.Bridge exploit$0
- ZetaChain Cross-Chain: Abort processing after call originating from Solana will cause loss of fundsLogic error$0
- ZetaChain Cross-Chain: SUI receiver lacks validationLogic error$0
- ZetaChain Cross-Chain: SUI TSS drained due to lack of refund when the `withdraw/withdraw_and_call()` PTB failsLogic error$0
- ZetaChain Cross-Chain: Malicious observer can block messages added through the inbound trackerBridge exploit$0
- ZetaChain Cross-Chain: Incorrect de-structuring of parse_intent()'s return value will trigger unexpected operationsLogic error$0
- ZetaChain Cross-Chain: Claiming delegation rewards via the precompile can result in a loss of ZETA rewards due to state synchronization issuesLogic error$0
- ZetaChain Cross-Chain: Malicious observer can drain Solana bridge by adding failed deposit transaction to inbound trackerBridge exploit$0
- ZetaChain Cross-Chain: TON transactions risk being lost due to flawed transaction handlingLogic error$0
- ZetaChain Cross-Chain: ZETA coin type outbound CCTXs can be sent to unsupported external chains, which results in a DoS of the outbound queueLogic error$0
- ZetaChain Cross-Chain: The `sender` argument for the Solana `OnCall` instruction can be impersonatedAccess control$0
- ZetaChain Cross-Chain: Missing Nonce Reset During TSS Address Update Allowing Signature ReplayLogic error$0
- ZetaChain Cross-Chain: Protocol fee is stuck in the `crosschain` moduleLogic error$0
- ZetaChain Cross-Chain: TON Gateway transactions with a skipped compute phase will cause a panicLogic error$0
- ZetaChain Cross-Chain: Setting `RevertGasLimit` to a value larger than `uint64` in the Solidity gateway contract will cause a panic that prevents finalizing the inbound CCTX and observers from receiving block rewardsLogic error$0
- ZetaChain Cross-Chain: Outbound CCTXs to external chains are not properly validated, preventing subsequent outbounds to the external chain from being processedLogic error$0
- ZetaChain Cross-Chain: Restricted addresses are still able to use Zetachain due to faulty updateAccess control$0
- ZetaChain Cross-Chain: An attacker can stuff a Solana Outbound transaction with multiple instructions to block it from finalizingLogic error$0
- ZetaChain Cross-Chain: Impartially aborted CCTXs are incorrectly marked as refunded, resulting in a loss of fundsLogic error$0
- ZetaChain Cross-Chain: Stateful precompiles panic on empty calldata, which can be exploited to prevent finalizing outbound CCTXsLogic error$0
- ZetaChain Cross-Chain: TON Gateway withdrawals can be DOS'd with an invalid withdrawal recipientLogic error$0