# Gas parameters for Stargate swap are hardcoded leading to stuck messages

Balancer hardcodes Stargate dstGasForCall to 0, so sgReceive reverts and cached swaps can be griefed into a long-term DoS on mTOFT.

- Payout: Contest reward
- Severity: medium
- Program: Tapioca
- Credited: GiuseppeDeLaZara
- Disclosed: 2024-02-14
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-02-tapioca-judging/issues/72
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AM-16
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm technique:chained technique:source-review vuln:access-control vuln:business-logic vuln:dos

**Target:** Balancer.sol / mTOFT.sgReceive cross-chain Stargate swap
**Root cause:** Balancer sets dstGasForCall=0 in the Stargate lzTxObj, so the destination sgReceive call gets no forwarded gas and reverts, leaving the swap in cachedSwapLookup. mTOFT.sgReceive also fails to validate chainId/srcAddress/token, letting anyone trigger it with a tiny transfer.
**Steps:**
1. Rebalance from Ethereum to Avalanche mTOFT fails because dstGasForCall=0, leaving 1000 USDC cached in Stargate cachedSwapLookup
2. Attacker initiates a Stargate swap from Ethereum to Avalanche for 1 USDT with mTOFT as receiver
3. mTOFT.sgReceive runs and transfers 1 USDC to TOFTVault, changing mTOFT's balance
4. clearCachedSwap for the original 1000 USDC now reverts because mTOFT lacks the full amount
5. Repeat to keep the cached swap permanently stuck
**How found:** Code review of Balancer's Stargate lzTxObj construction noticed dstGasForCall hardcoded to 0, then traced the payload through Bridge.lzReceive into Router.sgReceive and clearCachedSwap to see the cached-swap failure mode, and observed mTOFT.sgReceive validates none of its parameters.
**Exploitation:** Griever watches for a failed rebalance whose tokens sit cached on the destination mTOFT, then sends a minimal Stargate swap to that mTOFT so sgReceive drains part of the balance into the vault, making clearCachedSwap revert on insufficient funds; repeated to sustain the DoS.
**Insight:** When auditing cross-chain messaging, check that destination gas parameters are configurable per chain rather than hardcoded; a zero dstGasForCall still delivers the message but reverts the receiver, leaving funds in the bridge's cachedSwapLookup where any unauthenticated sgReceive caller can grief the retry.