# The difference between gasLeft and gasAfterTransfer is greater than TRANSFER_OVERHEAD, causing anyExecute to always fail

In BranchBridgeAgent._payExecutionGas, the gasLeft-to-gasAfterTransfer delta (~70k) always exceeds TRANSFER_OVERHEAD (24k), forcing _forceRevert so anyExecute always fails.

- Payout: Contest reward
- Severity: high
- Program: Maia DAO Ecosystem
- Credited: Koolex
- Disclosed: 2023-09-18
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-05-maia-findings/issues/610
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-maia%3AH-15
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** BranchBridgeAgent._payExecutionGas / anyExecute (Ulysses Omnichain)
**Root cause:** gasLeft is captured before _replenishGas and the ETH transfer, so the measured delta includes deposit and transfer costs (~70k) which always exceeds the 24_000 TRANSFER_OVERHEAD constant, making the guard always true.
**Steps:**
1. Deploy BranchBridgeAgent with Anycall executor/config and WETH9 mocks.
2. Fund the agent with WETH and call depositIntoWeth.
3. Prank as localAnyCallExecutorAddress and call `anyExecute{gas: 1 ether}(bytes(""))`.
4. Observe revert: gasLeft - gasAfterTransfer = 70368 > TRANSFER_OVERHEAD (24000), triggering _forceRevert.
**How found:** Code reading of _payExecutionGas: noticed gasLeft is checkpointed before _replenishGas and the ETH transfer rather than immediately before the transfer, so the delta includes deposit+transfer gas; hypothesized it exceeds the 24_000 constant and built a standalone Foundry PoC to measure the actual delta (~70k).
**Exploitation:** No attacker value extraction; the flaw is a logic/DoS bug where every cross-chain anyExecute call reverts because the gas-overhead guard is always true, breaking the bridge's inbound execution path.
**Insight:** When a contract uses a gas-delta guard to bound a specific external call's overhead, verify the checkpoint is placed immediately before that call; any intervening state writes or external calls (deposit, transfer) inflate the delta and can make the guard permanently true.