# When the anyExecute call is made to RootBridgeAgent with a depositNonce that has been recorded in executionHistory, initialGas and userFeeInfo will not be updated, which would affect the next caller of retrySettlement.

RootBridgeAgent.anyExecute early-returns on already-executed depositNonce without clearing initialGas/userFeeInfo, so a later retrySettlement caller uses stale fee state, causing revert or free retry.

- Payout: Contest reward
- Severity: medium
- Program: Maia DAO Ecosystem
- Credited: Emmanuel
- Disclosed: 2023-09-18
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-05-maia-findings/issues/676
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-maia%3AM-12
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** RootBridgeAgent.sol (Ulysses omnichain bridge)
**Root cause:** anyExecute sets initialGas and userFeeInfo at entry but returns early when executionHistory[fromChainId][nonce] is true, skipping _payExecutionGas which would zero them; the stale nonzero initialGas makes retrySettlement skip the caller-supplied msg.value/_remoteExecutionGas branch.
**Steps:**
1. Call `anyExecute` on RootBridgeAgent with a `depositNonce` already recorded in `executionHistory` so it returns early, leaving `initialGas != 0` and stale `userFeeInfo`.
2. Call `retrySettlement(_settlementNonce, _remoteExecutionGas)` directly; the `if (initialGas == 0)` guard is false so msg.value/_remoteExecutionGas are ignored.
3. Observe `_manageGasOut` takes the `_initialGas > 0` branch using stale `userFeeInfo.gasToBridgeOut`, reverting with InsufficientGasForFees or executing without caller funds.
**How found:** Code reading of retrySettlement's `initialGas == 0` assumption versus anyExecute's early-return path for already-executed nonces, tracing that _payExecutionGas (which resets state) is skipped.
**Insight:** When a function uses a shared state variable as an implicit 'am I being called internally?' flag, audit every early-return path in the internal caller to confirm the flag is reset before returning.