# Cross msg recipient can block checkpoint submission

Cross-message recipient returns a huge returndata gas bomb, exhausting gas in the low-level call and blocking checkpoint submission in Recall's gateway.

- Payout: Contest reward
- Severity: high
- Program: Recall
- Credited: SBSecurity
- Disclosed: 2026-03-13
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2025-02-recall#h-09
- Library page: https://bugbountylibrary.com/r/c4%3A2025-02-recall%3AH-09
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:dos

**Target:** LibGateway/CrossMsgHelper cross-message execution (EVM gateway)
**Root cause:** Low-level call returndata is unconditionally copied into memory with no size cap, so a malicious recipient can return a large payload that consumes all remaining gas.
**Steps:**
1. Deploy a contract as cross-msg recipient with a receive/handleIpcMessage that returns a very large returndata payload.
2. Trigger a cross-message (Call or Transfer kind) to that recipient via the gateway.
3. functionCallWithValue/performCall executes target.call and copies returndata into memory.
4. Returndata copy exhausts gas, reverting the whole checkpoint submission.
**How found:** Read the natspec claiming low-level call prevents checkpoint blocking, then reasoned that returndata is still loaded into memory unconditionally, allowing a gas bomb via return data.
**Exploitation:** Attacker registers as a cross-msg recipient and returns an oversized returndata blob (or uses receive for native Transfer) so the low-level call's implicit returndata copy consumes the entire gas limit, reverting checkpoint submission for all messages.
**Insight:** Low-level call still copies returndata into memory; a recipient returning huge data can grief any batch executor. Check returndata handling in cross-chain message loops, not just revert behavior.