# Incorrect return value of function BaseTapiocaOmnichainEngine._payNative()

BaseTapiocaOmnichainEngine._payNative returns only _nativeFee instead of msg.value, trapping excess native tokens and underfunding multi-message LayerZero sends.

- Payout: Contest reward
- Severity: medium
- Program: Tapioca DAO
- Credited: KIntern\_NA
- Disclosed: 2024-05-23
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-02-tapioca-findings/issues/153
- Library page: https://bugbountylibrary.com/r/c4%3A2024-02-tapioca%3AM-08
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Solidity omnichain engine contract (LayerZero OAppSender override)
**Root cause:** The override of _payNative returns the input _nativeFee rather than msg.value, so when a single transaction sends multiple LayerZero messages (Magnetar, Tap token) the excess msg.value is not forwarded and remains stuck in the contract.
**Steps:**
1. Call a Magnetar/Tap function that sends multiple LayerZero messages in one tx, passing msg.value > sum of fees (including LzComposeOption value).
2. Observe _payNative returns only _nativeFee, so only that amount is consumed per message.
3. Remaining msg.value - _nativeFee stays trapped in BaseTapiocaOmnichainEngine; some compose/withdraw flows fail for lack of native tokens.
**How found:** Compared the Tapioca override against LayerZero's OAppSender._payNative semantics and noticed multi-message flows (Magnetar, Tap) require returning more than _nativeFee.
**Insight:** When overriding framework hooks like _payNative, check whether the protocol batches multiple framework calls per transaction; the base contract's single-call assumption breaks and excess value gets stranded.