# IsWrappedFcash check is a gas bomb

Notional's _isWrappedFCash try-decode on arbitrary fCash position hits CETH fallback, consuming all gas and bricking setToken issue/redeem.

- Payout: Contest reward
- Severity: medium
- Program: Notional
- Credited: jonah1005
- Disclosed: 2022-07-18
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-notional-coop-findings/issues/188
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-notional-coop%3AM-04
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:dos

**Target:** notionalTradeModule _isWrappedFCash check in Set Protocol integration
**Root cause:** try IWrappedfCash(_fCashPosition).getDecodedID() returns(uint16,uint40) on a contract whose fallback succeeds but returns no/short data causes ABI decode revert that consumes all forwarded gas.
**Steps:**
1. Call issueModule.issue(setToken, amount, address(this)) with a setToken containing CETH as an fCash position component.
2. During _isWrappedFCash, getDecodedID is called on CETH; its payable fallback mints and returns empty data.
3. ABI decode of empty returndata reverts, burning all gas (observed ~19.4M vs ~30k for cDAI).
4. Subsequent redeem/issue fails or is prohibitively expensive; wallet contracts cannot interact.
**How found:** Noticed the try/catch decode pattern assumes non-reverting calls return correctly-typed data; tested _isWrappedFCash against cDAI vs CETH and observed massive gas delta.
**Insight:** When using try/catch around external calls with typed returns, a contract with a succeeding fallback (e.g. cETH) returns empty data and the ABI decode revert consumes all gas; always cap gas or check returndata length before decoding.