# Incorrect accounting logic for fallback gas will lead to insolvency

Maia Ulysses gas accounting double-spends deposited gas: root execution fees credited to accumulatedFees while branch fallback gas is separately withdrawn, draining the port's WETH.

- Payout: Contest reward
- Severity: medium
- Program: Maia DAO Ecosystem
- Credited: xuwinnie
- Disclosed: 2023-09-18
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-05-maia-findings/issues/313
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-maia%3AM-31
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** RootBridgeAgent/BranchBridgeAgent gas accounting (Anycall cross-chain messaging)
**Root cause:** Deposited gas is fully consumed on the execution side (excess to accumulatedFees on root, remainder refunded to recipient on branch) while fallback gas is separately withdrawn from the port, so the same deposited gas is spent twice.
**Steps:**
1. User initiates cross-chain call depositing 20 units gas, gasToBridgeOut=0.
2. On root, _payExecutionGas replenishes 12 units and adds 8 to accumulatedFees.
3. On branch, anyExecute fails and _payFallbackGas withdraws 14 units from the port and replenishes.
4. Net: 20 units in, 34 units out — port WETH balance insolvent.
**How found:** Code-reading of _payExecutionGas vs _payFallbackGas across root and branch: noticed excess gas is credited/refunded on execution side while fallback reserve is separately withdrawn, implying double spend.
**Exploitation:** Repeated failed cross-chain deposits cause the branch port's wrapped native token balance to be drained via _payFallbackGas withdrawals exceeding deposited gas.
**Insight:** In cross-chain gas accounting, check whether the fallback reserve is deducted from deposited gas at initiation or merely withdrawn later — if execution-side refunds and fallback withdrawals both draw on the same deposit, the port balance goes insolvent.