# DoS of RootBridgeAgent due to missing negation of return values for UniswapV3Pool.swap()

RootBridgeAgent fails to negate UniswapV3Pool.swap() negative return values, causing SafeCastLib.toUint128() overflow reverts that DoS all gas-swap paths.

- Payout: Contest reward
- Severity: medium
- Program: Maia DAO Ecosystem
- Credited: peakbolt
- Disclosed: 2023-09-18
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-05-maia-findings/issues/262
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-maia%3AM-38
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:dos

**Target:** RootBridgeAgent gas swap functions (Ulysses Omnichain)
**Root cause:** UniswapV3Pool.swap() returns negative int256 for exact-input swaps; _gasSwapIn/_gasSwapOut cast directly to uint256 without negation, producing huge values that overflow SafeCastLib.toUint128().
**Steps:**
1. Read UniswapV3 SwapRouter.exactInputInternal: return uint256(-(zeroForOne ? amount1 : amount0))
2. Compare to RootBridgeAgent._gasSwapIn/_gasSwapOut which return uint256(amount) without negation
3. Trace callers anyExecute() and _manageGasOut() applying .toUint128()
4. PoC: patch MockPool.swap() to `return (-amount0, -amount1);` in RootTest.t.sol#L1916
5. Run RootTest.testCallOutWithDeposit() — overflow revert breaks setUp()
**How found:** Code-reading comparison against Uniswap's own SwapRouter reference implementation, spotting the missing unary negation before the uint256 cast in the bridge's swap wrappers.
**Insight:** When a protocol wraps a Uniswap V3 pool swap directly, diff its return-value handling against SwapRouter.sol — the negative int256 convention for exact-input swaps is easy to miss and breaks downstream SafeCast conversions.