Economic DoS (Griefing) on IBC Relayers via `memo` Callback Gas Exploitation

How it was found

Summary of Impact

This vulnerability allows an attacker to bypass the relayer's simulation defense and force permissionless relayers to execute computationally expensive, but 'successful', transactions via the memo callback feature.

This creates an asymmetric economic attack where the relayer's cost (e.g., ~1,000,000 gas) vastly exceeds their profit leading to financial losses.

Relayers will be forced to stop servicing the affected IBC channel to avoid bankruptcy, causing a Denial of Service (DoS) for all applications relying on that channel's callbacks.

Steps to Reproduce

1. Identify the Callback Gas Limit: An attacker first inspects the chain's application setup file (e.g., app/app.go) to find the hardcoded gas limit for the IBC Callbacks middleware.

2. I have confirmed this value is set to 1,000,000 gas in the main application configuration.

3. Deploy a Malicious 'Gas Burner' Contract: The attacker deploys an EVM smart contract that performs computationally expensive operations (e.g., loops, hashing) designed to consume just under the limit (e.g., 990,000 gas) and then return 'success'.

4. This contract must not fail with 'Out of Gas' (OOG).

5. Send an IBC Packet with Malicious Memo: The attacker sends a standard IBC packet (e.g., MsgTransfer) and includes a memo field specifying the address of the 'Gas Burner' contract as the source callback.

6. Relayer Simulation is Bypassed: A relayer bot picks up the acknowledgment (MsgAcknowledgement) for this packet and runs a simulation.

7. Because the callback consumes 990,000 gas (which is less than the 1,000,000 limit) and returns 'success', the simulation passes, falsely identifying the transaction as safe.

8. Relayer Incurs Financial Loss: The relayer broadcasts the 'successful' transaction. The chain executes it, including the 990,000 gas callback.

9. The relayer must pay the full gas cost (~1,000,000 gas) but only receives their standard fee (which is 0 if ICS-29 is not used, or ~300,000 gas if it is).

10. Result (Griefing): The attacker can repeat this process, draining the relayer's funds at minimal cost, forcing the relayer to abandon the channel.

Mitigation

• 1. Reduce the Gas Limit: The simplest mitigation is to drastically reduce the hardcoded DefaultGasLimitForCallback in app/app.go from 1,000,000 to a value much closer to a standard relayer's profit margin.

• 2. Implement Dynamic Gas (Better): A more robust solution is to require the sender of the original packet to explicitly define (and pay for) the maximum gas their callback will use, similar to ICS-29 fees.

• 3. Smarter Simulation: Relayer clients could be updated to not only check for 'success' but also to report the total gas consumed by the simulation. Relayers could then set a local policy to reject 'successful' transactions that consume an unprofitable amount of gas.

Reference

• ICS-29 Fee Middleware: Understanding how relayers are supposed to be paid (and why their profit is often 0 or very low) is key to this economic exploit.

• Blockchain Griefing Attacks: This is a classic example of a griefing attack, where the attacker's goal is not direct profit, but to cause financial harm to another party to disrupt the network. [Source: scsfg.io - Smart Contract Security Field Guide]

Impact

• Immediate Relayer Bankruptcy: Any permissionless relayer servicing this chain's callback-enabled channels will be rapidly drained of funds and forced to shut down.

• Total Channel DoS: When relayers stop servicing the channel, all cross-chain applications that depend on IBC callbacks (e.g., cross-chain DeFi, NFT transfers) will cease to function, effectively freezing assets and operations.

• Loss of Trust: This attack breaks the fundamental economic incentive for the decentralized relayer network, demonstrating that the chain is economically unsafe to service and undermining trust in the entire IBC ecosystem connected to this chain.