# Overpaying remaining gas to the user for failing anyExecute call due to an incorrect gas unit calculation in BranchBridgeAgent

BranchBridgeAgent's MIN_EXECUTION_OVERHEAD underestimates real gas cost, so users are overpaid remaining gas and the anycall execution budget slowly drains.

- Payout: Contest reward
- Severity: high
- Program: Maia DAO Ecosystem
- Credited: Koolex
- Disclosed: 2023-09-18
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-05-maia-findings/issues/607
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-maia%3AH-16
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** BranchBridgeAgent.anyExecute gas accounting on destination chain
**Root cause:** MIN_EXECUTION_OVERHEAD (160k) only budgets 60k for pre-first and post-last gas checkpoints, but actual overhead is ~78k; anyExec MPC gas and calldata input fees are also unaccounted, so minExecCost undercharges.
**Steps:**
1. Read _payExecutionGas: minExecCost = tx.gasprice * (MIN_EXECUTION_OVERHEAD + _initialGas - gasLeft).
2. Note MIN_EXECUTION_OVERHEAD=160_000 with comment splitting 100k anycall + 35k pre + 25k post.
3. Build two contracts: full anyExecute vs one with pre/post checkpoint code commented out.
4. Run identical calls in Foundry; measure gas difference: 92852 - 14755 = 78097 > 60000.
5. Observe calldata input fee (4/16 per byte) and anyExec MPC gas (~110k) also excluded from minExecCost.
**How found:** Code-reading of the gas accounting formula and comparison against AnycallV7Config's own EXECUTION_OVERHEAD and chargeFeeOnDestChain logic; noticed the 60k pre/post budget was smaller than the actual measured overhead, then built a differential Foundry PoC to quantify it.
**Exploitation:** Any user triggering anyExecute on the destination chain pays less than actual gas; the excess gasRemaining is refunded to the recipient, and the bridge agent's anycall execution budget is replenished with an undercharge, slowly draining it until calls revert with 'no enough budget'.
**Escalation:** Repeated anyExecute calls with large calldata accelerate budget drain, eventually causing all anyExecute calls to fail.
**Insight:** When a contract reimburses gas using a hardcoded overhead constant, diff the constant against the actual measured pre/post-checkpoint gas and against the external protocol's own overhead accounting; calldata byte costs and outer-frame gas are commonly omitted.