# Cross-chain messaging via Anycall will fail

BranchBridgeAgent calls Anycall with flag 4 (pay-on-source) but sends no gas fee, so every cross-chain call reverts, breaking callOut, callOutSigned and retryDeposit.

- Payout: Contest reward
- Severity: high
- Program: Maia DAO Ecosystem
- Credited: ltyu
- Disclosed: 2023-09-18
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-05-maia-findings/issues/91
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-maia%3AH-34
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:dos vuln:misconfiguration

**Target:** BranchBridgeAgent._performCall / Anycall V7 integration
**Root cause:** _performCall uses AnycallFlags.FLAG_ALLOW_FALLBACK (flag 4), which requires the source-chain gas fee to be paid, but anyCall is invoked without supplying value, so Anycall rejects the call.
**Steps:**
1. Read AnycallFlags.sol: FLAG_ALLOW_FALLBACK = 4.
2. Check Anycall V7 docs/code: flag 4 means fee paid on source chain.
3. Inspect BranchBridgeAgent._performCall: `IAnycallProxy(localAnyCallAddress).anyCall(rootBridgeAgentAddress, _calldata, rootChainId, AnycallFlags.FLAG_ALLOW_FALLBACK, "")` with no `{value: _fee}`.
4. Call any dependent function (callOut, callOutSigned, retryDeposit) and observe revert due to missing source fee.
**How found:** Code-reading of the Anycall integration: compared the flag constant used in _performCall against Anycall V7 documentation and reference implementation, noticing the pay-on-source flag was used without attaching a fee.
**Insight:** When integrating a cross-chain messaging library, cross-check the flag/parameter semantics against the provider's reference contract; a flag that selects fee-payment mode silently requires msg.value that the call site omits.