# Due to inadequate checks, an adversary can call BranchBridgeAgent#retrieveDeposit with an invalid _depositNonce, which would lead to a loss of other users' deposits.

Missing owner check in BranchBridgeAgent#retrieveDeposit lets anyone pre-mark a future depositNonce as executed on root chain, bricking a victim's deposit.

- Payout: Contest reward
- Severity: high
- Program: Maia DAO Ecosystem
- Credited: Emmanuel
- Disclosed: 2023-09-18
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-05-maia-findings/issues/688
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-maia%3AH-08
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic

**Target:** BranchBridgeAgent#retrieveDeposit cross-chain deposit nonce handling
**Root cause:** retrieveDeposit lacks a msg.sender == deposit owner check, so anyone can send flag 0x08 with an arbitrary future _depositNonce; RootBridgeAgent#anyExecute toggles executionHistory[fromChainId][nonce]=true for that nonce.
**Steps:**
1. Note current global depositNonce (e.g. 50).
2. Call `BranchBridgeAgent#retrieveDeposit(60)` with fallback gas; packedData flag `0x08` + nonce 60 is sent cross-chain.
3. RootBridgeAgent#anyExecute sees flag 0x08, executionHistory[fromChainId][60] is false, sets it true.
4. Victim later calls `callOutAndBridge` and is assigned depositNonce 60.
5. Victim's deposit is collected on branch but root execution reverts/forceReverts since executionHistory[60] already true; anyFallback not triggered, funds locked.
**How found:** Code review of retrieveDeposit versus retryDeposit: noticed retryDeposit enforces msg.sender == getDeposit[_depositNonce].owner but retrieveDeposit does not, then traced anyExecute flag 0x08 to see it blindly toggles executionHistory for any nonce.
**Exploitation:** Attacker front-runs by calling retrieveDeposit with a nonce ahead of the current global depositNonce, poisoning executionHistory on the root chain for that nonce. When a victim's deposit later receives that nonce, root-side execution is skipped and no fallback fires, so the victim's tokens are collected on the branch chain but never credited on root.
**Escalation:** Attacker can squat many future nonces to grief multiple users or lock deposits at scale.
**Insight:** When two sibling functions (retry vs retrieve) handle the same nonce, diff their access checks; anyExecute handlers that set executionHistory from an unvalidated nonce enable nonce-squatting griefing.