# Malicious users can abuse the 63/64 rule to skip executeFromExecutor() calls

Anyone can call processBridgedExecution with crafted gas so the 63/64 rule starves executeFromExecutor, silently skipping account logic while the tx succeeds.

- Payout: Contest reward
- Severity: medium
- Program: Superform
- Credited: samuraii77
- Disclosed: 2025-07-17
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_superform_may2025.pdf#3.2.1
- Library page: https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.2.1
- Tags: domain:web3 impact:dos impact:integrity kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** SuperDestinationExecutor::processBridgedExecution on-chain executor
**Root cause:** processBridgedExecution is permissionless and wraps executeFromExecutor in try/catch; a caller can supply gas such that only 1/64 remains for the inner call, forcing OOG into the catch block while the outer tx succeeds.
**Steps:**
1. Observe processBridgedExecution() is callable by anyone and forwards to IERC7579Account(account).executeFromExecutor(...) inside try/catch.
2. Copy the calldata of a legitimate AcrossV3Adapter call to the destination executor.
3. Frontrun the legitimate call, sending the same calldata with gas tuned so ~128000 gas remains at the external call (catch block needs ~2000 gas = 1/64).
4. 126000 gas is forwarded to executeFromExecutor, insufficient for the account logic, so it OOGs into the catch Panic branch and emits the event.
5. Outer call succeeds without executing account logic; the real adapter call then reverts (e.g. MERKLE_ROOT_ALREADY_USED).
**How found:** Noticed processBridgedExecution is permissionless and deterministic per input, then reasoned about EIP-150 63/64 gas forwarding to starve the inner executeFromExecutor call into the catch branch.
**Exploitation:** Attacker frontruns a legitimate bridged execution with identical calldata and a gas limit calibrated so the 63/64 rule leaves only 1/64 for executeFromExecutor; the inner call OOGs, the catch block emits the event, and the transaction succeeds without performing the intended account logic, causing the genuine adapter call to revert.
**Insight:** When a permissionless function wraps a critical external call in try/catch, the 63/64 rule lets an attacker pick a gas limit that OOGs the inner call into the catch while the outer tx succeeds — check catch-block gas cost vs 1/64 of remaining gas.