# When using BaseBranchRouter as a router on the 'Arbitrum' branch, we are unable to invoke the 'callOutAndBridge' function.

ArbitrumBranchPort pulls hTokens from the router via RootPort, but the router only approved the local port, so callOutAndBridge reverts on Arbitrum.

- Payout: Contest reward
- Severity: medium
- Program: Maia DAO
- Credited: ether\_sky
- Disclosed: 2023-11-29
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-09-maia-findings/issues/744
- Library page: https://bugbountylibrary.com/r/c4%3A2023-09-maia%3AM-02
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** ArbitrumBranchPort / BaseBranchRouter deposit flow
**Root cause:** ArbitrumBranchPort._bridgeOut calls RootPort.bridgeToRootFromLocalBranch with the router as _depositor, but the router only approved ArbitrumBranchPort, not RootPort, so the safeTransferFrom in RootPort fails.
**Steps:**
1. Deploy Arbitrum branch with BaseBranchRouter as router.
2. User approves router for hToken and underlying token.
3. Call `arbitrumMulticallRouter.callOutAndBridge{value:1 ether}("", depositInput, gasParams)` with amount 150 ether, deposit 100 ether.
4. Router transfers/approves tokens to localPort; BranchBridgeAgent._createDeposit calls `IPort(localPortAddress).bridgeOut(...)`.
5. ArbitrumBranchPort._bridgeOut calls `IRootPort(rootPortAddress).bridgeToRootFromLocalBranch(_depositor=router, _localAddress, _amount-_deposit)`.
6. RootPort does `_hToken.safeTransferFrom(_from=router, address(this), _amount)` which reverts since router approved only the local port.
**How found:** Code-reading of the Arbitrum branch deposit path: noticed Arbitrum has no local/global hToken distinction so tokens go straight to RootPort, then traced the approval target mismatch between router (approves localPort) and RootPort's transferFrom(_depositor).
**Insight:** When a port delegates a pull to another contract (RootPort), check that the router's approve target matches the contract actually executing safeTransferFrom, not just the immediate port.