ZetaChain · FINDING NOTE
Broadcast delays could leave cross-chain tracking incomplete
Collaborative submission by 0xpetern. View the public report
From collaborative work with 0xpetern. Sherlock credits 0xpetern with the accepted Medium finding M-30.
1 min read
Page link
Summary
A transaction could reach an external EVM network while ZetaChain failed to record the corresponding outbound tracking information. The report connected this mismatch to how the broadcaster handled slow network responses.
Root cause
Broadcast timeouts and recovery logic did not adequately distinguish a delayed response from a transaction that had not been sent. That ambiguity could leave the protocol’s transaction tracking incomplete.
Attack scenario
The failure could arise during ordinary cross-chain activity on a slow or congested network. The report does not depend on a privileged attacker; the concern is unreliable communication between systems.
Impact
Users could encounter failed cross-chain operations while operators were left with missing trackers and inconsistent transaction state between ZetaChain and an external network.
Fix recommendation
Allow realistic response times and reconcile uncertain broadcast outcomes before retrying. Sherlock lists a fix, but its linked pull request addresses Sui withdrawals, so that link does not confirm the reported EVM timeout correction.