# Payable value forwarding mismatch

Payable entrypoint whose msg.value is dropped, misrouted, or sent to a non-payable callee

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2023-10-09. Updated 2026-10-24._

## How it works
A function is marked `payable`, so callers and integrators assume it accepts ETH. But the value never reaches its destination: the entrypoint omits `{value: msg.value}` on an internal call, the callee lacks `payable` and reverts, or a batch loop swallows per-item failures and strands the ETH. The broken assumption is that `payable` on the entrypoint implies value flows end-to-end. It does not; each hop must forward and accept value.

## Where it shows up
- A `payable` function that calls another contract or library without `{value: msg.value}`.
- `delegatecall` into a shared implementation whose target function is not `payable` (delegatecall preserves `msg.value`, so the callee reverts when value > 0).
- Governance/executor chains where the outer action is payable but the executor call is not.
- Batch loops that self-call with value and do not revert on inner failure.
- Value checks comparing aggregate against `msg.value` rather than the contract's actual balance.

## How to review
Trace `msg.value` from every `payable` entrypoint through each intermediate call to the final recipient. The invariant: for any path that accepts value, every callee in the chain is `payable` and receives `{value: ...}`, and the sum forwarded equals the sum received. For batch/loop paths, confirm failed items either revert the whole call or their value is refunded/swept, and that accounting uses contract balance, not just `msg.value`. A `payable` keyword with no forwarding is a red flag, not a feature.

## Variants seen
- Payable entrypoint delegatecalls a non-payable library function; all ETH deposits revert [E1](https://bugbountylibrary.com/r/sherlock%3A2023-10-notional%3AM-5.md).
- Payable governance action omits value forwarding to a non-payable executor; value-bearing actions revert with OutOfFund [E2](https://bugbountylibrary.com/r/c4%3A2023-06-llama%3AM-01.md).
- Batch force-deploy forwards ETH per item, swallows failures, and strands ETH in the contract [E3](https://bugbountylibrary.com/r/c4%3A2023-03-zksync%3AM-05.md).

## Impact and severity
Functionality is fully broken for value-bearing paths: ETH-pool vault deposits revert entirely [E1](https://bugbountylibrary.com/r/sherlock%3A2023-10-notional%3AM-5.md), governance actions needing ETH cannot execute [E2](https://bugbountylibrary.com/r/c4%3A2023-06-llama%3AM-01.md), and funds sent during batch deployment are stranded [E3](https://bugbountylibrary.com/r/c4%3A2023-03-zksync%3AM-05.md). Severity rises with irrecoverable stranded funds and with core flows (deposits, governance) being unusable. Silent stranding is worse than a clean revert because it is easy to miss.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2023-10-notional%3AM-5.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-06-llama%3AM-01.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-03-zksync%3AM-05.md