# Due to missing checks on minimum gas passed through LayerZero, executions can fail on the destination chain

DecentEthRouter lets users set arbitrary _dstGasForCall added to hardcoded 100k relay gas, so underfunded LayerZero calls revert out-of-gas and permanently block the cross-chain channel.

- Payout: Contest reward
- Severity: high
- Program: Decent
- Credited: iamandreiski
- Disclosed: 2024-03-22
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2024-01-decent-findings/issues/525
- Library page: https://bugbountylibrary.com/r/c4%3A2024-01-decent%3AH-02
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** DecentEthRouter bridge/bridgeWithPayload LayerZero adapter params
**Root cause:** GAS_FOR_RELAY is hardcoded at 100000 and _dstGasForCall is user-supplied without validation against estimateSendAndCallFee, so total gasAmount can be insufficient for the destination call.
**Steps:**
1. Call `bridgeWithPayload(_dstChainId, _toAddress, _amount, deliverEth, 1000, payload)` with `_dstGasForCall=1000`.
2. `_getCallParams` computes `gasAmount = 100000 + 1000 = 101000` and packs `abi.encodePacked(PT_SEND_AND_CALL, gasAmount)` as adapterParams.
3. Destination execution runs out of gas; message transitions INFLIGHT -> STORED instead of SUCCESS.
4. STORED message blocks all subsequent messages from source to that destination chain until retried to SUCCESS.
**How found:** Read LayerZero integration checklist (200k default, 2M for Arbitrum) and compared to hardcoded GAS_FOR_RELAY=100000; traced _getCallParams to see _dstGasForCall is unvalidated and user-controlled.
**Exploitation:** Attacker or unaware user submits a bridge/bridgeWithPayload with a tiny _dstGasForCall (e.g. 1000) or a payload that forces OOG in DecentBridgeExecutor; the destination call reverts out-of-gas, the message is STORED, and the LayerZero channel between source and destination is permanently blocked.
**Escalation:** Judge notes DecentBridgeExecutor permits arbitrary calls that can force OOG regardless of gas limit, so even raising GAS_FOR_RELAY is insufficient; channel-wide DoS.
**Insight:** On LayerZero OFT integrations, check whether the adapterParams gas amount is derived from a user-supplied value plus a hardcoded constant; a low value causes STORED messages that block the entire channel, and executor arbitrary-call paths can force OOG even with adequate gas.