# Attacker can force the failure of transactions that use tryCatch

Relayer picks a gas limit so tryCatch's sub-call OOGs under EIP-150 1/64 rule while the wallet tx still succeeds, incrementing nonce and burning the user's fee.

- Payout: Audit contest
- Severity: medium
- Program: Ambire
- Found by: adriro
- Disclosed: 2023-08-04
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2023-05-ambire#m-02
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-ambire%3AM-02
- Tags: area:web3 domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** AmbireAccount smart contract tryCatch() via relayer/execute
**Root cause:** tryCatch forwards gasleft() to the sub-call; EIP-150 reserves only 1/64th, so a chosen gas limit makes the inner call OOG while the outer execute() still completes and increments the nonce.
**Steps:**
1. User signs a bundle whose sub-transaction calls `tryCatch(to, value, data)` on an expensive target.
2. Attacker/relayer submits `executeBySender{gas: 450_000}(txns)` (or execute with signature) with a gas limit tuned so the inner call runs out of gas.
3. Inner call fails, LogErr emitted, but outer execute() succeeds and increments the nonce.
4. User's signed payload is consumed; sub-transaction never executed as intended.
**How found:** Reading tryCatch's `gas: gasleft()` forwarding and applying EIP-150's 1/64th rule to reason that the inner call can be starved while the outer context retains gas to finish.
**Exploitation:** Malicious relayer takes the user's fee and submits the bundle with a gas limit just below what the tryCatch sub-call needs; the sub-call OOGs, the outer tx succeeds, nonce increments, and the user must re-sign while the relayer keeps payment.
**Escalation:** Judge notes it also applies to tryCatchLimit by passing a lower gasLimit.
**Insight:** Any contract forwarding `gasleft()` to an external call and treating failure as benign is griefable: the caller can tune the tx gas limit so the inner call OOGs under the 1/64 rule while the outer frame still completes and consumes the nonce/fee.