# RootBridgeAgent.redeemSettlement can be front-run using RootBridgeAgent.retrySettlement, causing redeem to DoS

Anyone can call retrySettlement on a failed settlement with zero remote gas, marking it Success and blocking the owner's redeemSettlement, locking their assets.

- Payout: Contest reward
- Severity: medium
- Program: Maia DAO Ecosystem
- Credited: 0xTheC0der
- Disclosed: 2023-09-18
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-05-maia-findings/issues/869
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-maia%3AM-03
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:dos

**Target:** RootBridgeAgent.sol (Ulysses Omnichain bridge settlement)
**Root cause:** retrySettlement lacks access control and marks the settlement SettlementStatus.Success even when called with _remoteExecutionGas = 0, so a later redeemSettlement reverts with SettlementRedeemUnavailable.
**Steps:**
1. Create a failed settlement for a user (settlement.status == Failed).
2. As any address, call `multicallBridgeAgent.retrySettlement{value: 1 ether}(settlementNonce, 0)` with _remoteExecutionGas = 0.
3. Observe settlement.status becomes SettlementStatus.Success.
4. User calls `redeemSettlement(settlementNonce)` which reverts with `SettlementRedeemUnavailable()`.
5. User's assets remain unredeemed (balance 0).
**How found:** Code reading of retrySettlement/redeemSettlement: noticed retrySettlement is callable by anyone for any settlement and unconditionally marks status Success, then hypothesized a zero-gas retry would DoS the owner's redeem; confirmed via modified Foundry test.
**Exploitation:** Attacker front-runs or races the victim's redeemSettlement by calling retrySettlement with zero remote execution gas, flipping the settlement to Success so the victim's redeem reverts; victim must then retry with gas and redeem, wasting time/gas.
**Escalation:** Can be repeated to repeatedly grief the user's failed settlement if economic incentives exist.
**Insight:** When a retry/replay function is permissionless and mutates settlement state to a terminal status, check whether a zero-cost/no-op invocation can flip state and block the legitimate owner's redeem path.