Why did the DAO soft fork had a DOS attack vector?

Question

It has been said that the soft-fork initially proposed to solve the whole DAO situation had a fatal attack vector that posed a danger to the whole network. I do not contest this fact, as it has been widely accepted, I'm just trying to understand it. The initial statement released was:

But the soft fork creates a denial of service attack vector which, if exploited, would prevent the network from processing valid transactions at negligible expense to the attacker. Specifically, an attacker can flood the network with transactions that execute difficult computation, and end by performing an operation on the DAO contract

From: http://hackingdistributed.com/2016/06/28/ethereum-soft-fork-dos-vector/

But this seems at odds with this other excerpt:

Ethereum transactions are atomic - if an exception is thrown, all state transitions are reverted. The only exception to this rule (no pun intended) is gas payment - any gas used up until the OutOfGas exception is deducted and sent to the miners.

From: https://github.com/ebuchman/evm-tools/blob/master/analysis/guide.md

So it seems to me that the attack vector would not "come for free" for the attacker, who would still have to pay some gas to perform these useless operations. Assuming the gas used per operation is really proportional to the actual amount of work each node must perform, it would seem to me that in order to considerably pull off the attack it would still cost a considerable amount of resources. Wouldn't it?

Answer 1

Soft fork transactions would not be included in a block, so there's no way for miners to be paid.

A key difference with all other transactions that encounter an exception, is that they are included in the blockchain. Inclusion in the blockchain is the consensus for how miners are effectively paid. A transaction with an exception has all state reverted, miners are paid for all gas, and is included in the blockchain.

Answer 2

An attacker can create an arbitrarily computationally-intensive and obfuscated script that calls the blacklisted addresses, and then do this over and over. This clogs up resources and the miners cannot be paid because such a transaction is not included. It is free because the miners do not get the gas.