# If RootBridgeAgent.lzReceiveNonBlocking reverts internally, the native token sent by relayer to RootBridgeAgent is left in RootBridgeAgent

Failed lzReceiveNonBlocking leaves relayer-sent native tokens stranded in RootBridgeAgent; attacker triggers fallback to sweep the entire balance.

- Payout: Contest reward
- Severity: medium
- Program: Maia DAO
- Credited: nobody2018
- Disclosed: 2023-11-29
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-09-maia-findings/issues/518
- Library page: https://bugbountylibrary.com/r/c4%3A2023-09-maia%3AM-07
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:accounting-error vuln:business-logic

**Target:** RootBridgeAgent.lzReceive / lzReceiveNonBlocking (LayerZero V2 airdrop)
**Root cause:** lzReceive swallows lzReceiveNonBlocking failures for non-ARB senders without reverting, so the native token airdropped by the relayer stays in the contract; _performFallbackCall later sends address(this).balance to the refundee.
**Steps:**
1. Alice calls BranchBridgeAgent.callOutSignedAndBridge with _hasFallbackToggled=false and remoteBranchExecutionGas=1 ether; message ftm->arb->mainnet.
2. Relayer airdrops 1 ether to RootBridgeAgent then calls lzReceive; _execute's bridgeAgentExecutorAddress.call fails, reverting ExecutionFailure inside lzReceiveNonBlocking.
3. lzReceive sees success=false but msg.sender != getBranchBridgeAgent[localChainId], so it does not revert; 1 ether remains in RootBridgeAgent.
4. Bob calls callOutSignedAndBridge with _hasFallbackToggled=true and _params calldata crafted to revert in the executor.
5. _execute hits _performFallbackCall, which calls ILayerZeroEndpoint.send{value: address(this).balance}, sweeping all stranded native tokens; excess gas refunded to Bob.
**How found:** Code reading of lzReceive's non-reverting branch for non-ARB senders combined with _execute's use of address(this).balance in _performFallbackCall, showing stranded airdrop funds are sweepable.
**Exploitation:** Attacker waits for any failed message to strand relayer ETH in RootBridgeAgent, then submits a message with fallback toggled and a deliberately reverting payload so _performFallbackCall forwards the contract's entire balance to the attacker's refundee address.
**Insight:** When a contract holds native tokens from an external relayer airdrop and a fallback path forwards address(this).balance, check whether the outer receive wrapper swallows inner reverts — any stranded balance becomes claimable by the next fallback-toggled message.