# StargateRouter cannot send payloads and rebalancing of ERC20s is broken

Tapioca's Balancer.sol calls StargateRouter.swap with a non-empty payload, which always reverts, breaking cross-chain ERC20 rebalancing.

- Payout: Contest reward
- Severity: medium
- Program: Tapioca
- Credited: GiuseppeDeLaZara
- Disclosed: 2024-02-14
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-02-tapioca-judging/issues/68
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AM-13
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** Balancer.sol cross-chain rebalance via Stargate router
**Root cause:** StargateRouter.swap reverts when a non-empty payload is supplied; payloads require StargateComposer. Balancer.sol hardcodes payload "0x" and uses StargateRouter, so ERC20 rebalance transfers revert.
**Steps:**
1. Fork Ethereum mainnet.
2. Call `IStargateRouter(0x8731...1e98).swap{value:1 ether}(111,3,3,payable(this),1e18,1,lzTxObj(0,0,"0x00"),abi.encode(address(this)),"0x")` with DAI approval.
3. Observe transaction reverts due to non-empty payload on StargateRouter.
**How found:** Code review of Balancer.sol rebalance: noticed payload "0x" passed to router.swap and that retryRevert implies StargateRouter usage; confirmed via forked PoC that router.swap reverts with payload, and docs say StargateComposer is required for payloads.
**Insight:** When integrating Stargate, check whether the call carries a payload: StargateRouter rejects payloads and StargateComposer must be used, but Composer lacks retryRevert, so interface choice must match payload usage.