# Malicious manipulation of gas reserve can deny access to MIMOProxy

MIMOProxy stores minGasReserve in proxy storage; a delegatecall target can set it to max, underflowing the gas stipend and permanently bricking the proxy.

- Payout: Contest reward
- Severity: medium
- Program: Mimo DeFi
- Credited: horsefacts
- Disclosed: 2022-10-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-08-mimo-findings/issues/158
- Library page: https://bugbountylibrary.com/r/c4%3A2022-08-mimo%3AM-03
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:dos

**Target:** MIMOProxy smart contract execute/delegatecall
**Root cause:** minGasReserve lives in proxy storage and is writable by any delegatecall target, but has no owner-only setter; once set above gasleft(), stipend = gasleft() - minGasReserve underflows and execute always reverts.
**Steps:**
1. Deploy attacker contract with same storage layout as MIMOProxy (owner, minGasReserve, _permissions).
2. Add function setGasReserve() that writes minGasReserve = type(uint256).max (selector 0x5f9981ae).
3. Victim calls `proxy.execute(attacker, "0x5f9981ae")`, overwriting proxy storage.
4. Any subsequent `proxy.execute(...)` reverts on underflow computing stipend; no path to reset minGasReserve.
**How found:** Code reading: noticed minGasReserve is public storage with no setter (removed from PRBProxy v2.0), and that execute computes gasleft() - minGasReserve, so a delegatecall target sharing storage layout can overwrite it.
**Exploitation:** Attacker tricks or induces the proxy owner into delegatecalling a malicious target whose function writes minGasReserve to type(uint256).max; all future execute calls revert, permanently locking the proxy.
**Insight:** When a proxy delegatecalls arbitrary targets, any storage variable used in arithmetic on the execute path is attacker-writable; check for unsettable config vars that can brick the proxy via underflow.