It has been said that the soft-fork initially proposed to solve the whole DAO situation had a fatal attack vector that posed a danger to the whole network. I do not contest this fact, as it has been widely accepted, I'm just trying to understand it. The initial statement released was:
But the soft fork creates a denial of service attack vector which, if exploited, would prevent the network from processing valid transactions at negligible expense to the attacker. Specifically, an attacker can flood the network with transactions that execute difficult computation, and end by performing an operation on the DAO contract
But this seems at odds with this other excerpt:
Ethereum transactions are atomic - if an exception is thrown, all state transitions are reverted. The only exception to this rule (no pun intended) is gas payment - any gas used up until the OutOfGas exception is deducted and sent to the miners.
So it seems to me that the attack vector would not "come for free" for the attacker, who would still have to pay some gas to perform these useless operations. Assuming the gas used per operation is really proportional to the actual amount of work each node must perform, it would seem to me that in order to considerably pull off the attack it would still cost a considerable amount of resources. Wouldn't it?