# It is not possible to execute actions that require ETH (or other protocol token)

LlamaCore.executeAction is payable but never forwards msg.value to LlamaExecutor.execute, so any governance action requiring ETH value reverts with OutOfFund.

- Payout: Contest reward
- Severity: medium
- Program: Llama
- Credited: libratus
- Disclosed: 2023-07-26
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-06-llama-findings/issues/247
- Library page: https://bugbountylibrary.com/r/c4%3A2023-06-llama%3AM-01
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity vuln:business-logic

**Target:** LlamaCore/LlamaExecutor governance execution contracts
**Root cause:** LlamaCore.executeAction accepts msg.value but calls executor.execute without {value: msg.value}, and LlamaExecutor.execute is non-payable, so the downstream call{value: value} has no ETH balance and reverts.
**Steps:**
1. Modify test _createAction to pass value=1 in createAction and ActionInfo
2. Change _executeAction to call `mpCore.executeAction{value: actionInfo.value}(actionInfo)`
3. Make MockProtocol.pause payable
4. Run `forge test -m test_RevertIf_ActionExecuted`; fails with EvmError: OutOfFund
**How found:** Code reading: noticed executeAction is payable but the internal executor.execute call omits value forwarding, and LlamaExecutor.execute lacks payable, so value-bearing actions cannot succeed.
**Insight:** When a function is marked payable, trace whether msg.value is actually forwarded through every intermediate call; a non-payable intermediate in the chain silently breaks all value-bearing actions.