# User may force fail the action from the DAO:execute

A malicious voter can supply just enough gas so a DAO:execute sub-call fails via EIP-150's 63/64 rule while the outer execute still succeeds.

- Payout: Audit contest
- Severity: medium
- Program: Aragon Protocol
- Found by: V_B
- Disclosed: 2023-12-12
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2023-03-aragon#m-01
- Library page: https://bugbountylibrary.com/r/c4%3A2023-03-aragon%3AM-01
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:dos vuln:governance

**Target:** DAO.sol execute / MajorityVotingBase voting execution
**Root cause:** execute forwards all gas to each action call, but EIP-150 only passes 63/64 to the child frame; a caller choosing gas so 63/64*gas < action cost makes the action revert while 1/64 leftover still completes execute.
**Steps:**
1. Proposal action needs ~700k gas and is marked allowed-to-fail in allowFailureMap.
2. Attacker calls execute with ~711.1k gas so 63/64*711.1k < 700k.
3. Child call reverts, failureMap bit set, but remaining 1/64 gas finishes execute successfully.
4. Action silently fails despite being expected to succeed.
**How found:** Reasoned about EIP-150 63/64 gas forwarding combined with execute's all-gas forwarding and allowFailureMap semantics, then computed gas thresholds for a 700k action.
**Exploitation:** Malicious voter/executor picks gas precisely so the target action's call frame runs out of gas under the 63/64 rule, causing the action to fail while execute returns success; forces proposal failure and griefs governance.
**Insight:** When a contract forwards all gas to external calls and tolerates failures, the caller controls the 63/64 boundary; check whether an action can be starved of gas while the outer tx still succeeds.