# BaseBranchRouter._transferAndApproveToken may revert in some cases

BaseBranchRouter calls ERC20.approve expecting a bool return; mainnet USDT returns no data, so callOutAndBridge reverts, blocking bridging with USDT.

- Payout: Contest reward
- Severity: medium
- Program: Maia DAO
- Credited: nobody2018
- Disclosed: 2023-11-29
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-09-maia-findings/issues/520
- Library page: https://bugbountylibrary.com/r/c4%3A2023-09-maia%3AM-06
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:dos

**Target:** BaseBranchRouter._transferAndApproveToken / callOutAndBridge
**Root cause:** Solmate ERC20.approve declares a bool return, so the compiler requires 1 byte of returndata; mainnet USDT.approve returns nothing (0 bytes), causing a revert.
**Steps:**
1. Fork mainnet at block 18283438
2. Call `ERC20(USDT).approve(spender, 1000e6)` via solmate ERC20 cast -> reverts (returndata length 0 != 1)
3. Call `IUSDT(USDT).approve(...)` or `SafeTransferLib.safeApprove` -> succeeds
4. Any callOutAndBridge with USDT deposit hits line 175 and reverts
**How found:** Noticed USDT's approve signature lacks a return value versus solmate ERC20's bool return, reasoned about compiler returndata length check, confirmed with a Foundry fork PoC.
**Exploitation:** Not an attack; DoS precondition: any user bridging USDT through BaseBranchRouter reverts, blocking the function.
**Insight:** When casting an arbitrary token to a typed ERC20 interface, the compiler enforces exact returndata size; non-standard tokens like mainnet USDT (no return) revert. Use SafeTransferLib/safeApprove or low-level call for tokens you don't control.