# User may underpay for the remote call ExecutionGas on the root chain

RootBridgeAgent's minExecCost omits AnycallV7's premium fee, so users underpay execution gas and the protocol absorbs the shortfall.

- Payout: Contest reward
- Severity: high
- Program: Maia DAO Ecosystem
- Credited: Evo
- Disclosed: 2023-09-18
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-05-maia-findings/issues/612
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-maia%3AH-14
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:fee-bypass

**Target:** RootBridgeAgent / BranchBridgeAgent gas payment logic
**Root cause:** minExecCost is computed as tx.gasprice * gasUsed, but AnycallV7's chargeFeeOnDestChain charges gasUsed * (tx.gasprice + _feeData.premium), so the premium is never collected from the user.
**Steps:**
1. Read AnycallV7Config.chargeFeeOnDestChain: totalCost = gasUsed * (tx.gasprice + _feeData.premium)
2. Read RootBridgeAgent._payExecutionGas L811: minExecCost = tx.gasprice * (MIN_EXECUTION_OVERHEAD + _initialGas - gasleft())
3. Observe premium term missing; same flaw in _payFallbackGas (Root L836, Branch L1066) and Branch _payExecutionGas L1032
4. User deposits only minExecCost, leaving budget short of actual chargeFeeOnDestChain cost
**How found:** Cross-referenced AnycallV7's chargeFeeOnDestChain formula against Maia's minExecCost computation and spotted the missing _feeData.premium term.
**Exploitation:** User pays less than the actual execution cost; the deficit is drawn from the execution budget, causing protocol/other-user loss on each remote call.
**Insight:** When integrating a third-party fee/gas protocol, diff your cost formula term-by-term against the protocol's actual charge function (here tx.gasprice + premium); premium/markup terms are commonly omitted.