# msg.value misattribution in multicall

Shared msg.value spent by the wrong call leg; per-call payer intent ignored

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2025-04-03. Updated 2026-10-29._

## How it works
A multicall batch carries a single `msg.value` for the whole batch, but the internal function that spends it branches only on `msg.value > 0`, not on who the call is for. The first leg that reaches the branch consumes the ETH, so a later leg (or the intended payer) is left with nothing. The broken assumption: that `msg.value` belongs to the current call's intent, when it is global to the batch [E2](https://bugbountylibrary.com/r/cantina%3Asize_february2025%3A3.1.3.md).

## Where it shows up
- Internal deposit/execute functions with `if (msg.value > 0)` that also serve an "on behalf of" entrypoint [E2](https://bugbountylibrary.com/r/cantina%3Asize_february2025%3A3.1.3.md)
- Multicall wrappers that forward the full `msg.value` to the first sub-call [E2](https://bugbountylibrary.com/r/cantina%3Asize_february2025%3A3.1.3.md)
- A deposit path that wraps the caller's ETH as the source even when the call names a different payer [E2](https://bugbountylibrary.com/r/cantina%3Asize_february2025%3A3.1.3.md)

## How to review
For every external entrypoint reaching a `msg.value`-branching function, check that the payer and the beneficiary are the same party the branch assumes. The invariant: ETH attached to a call must be credited to the account the call names, and no leg may spend value intended for another. In a behalf-deposit, the authorizer's WETH should be the source, not the caller's ETH [E2](https://bugbountylibrary.com/r/cantina%3Asize_february2025%3A3.1.3.md).

## Variants seen
- Behalf-deposit in multicall: operator's ETH becomes the member's collateral, operator's own deposit gets nothing [E2](https://bugbountylibrary.com/r/cantina%3Asize_february2025%3A3.1.3.md)

## Impact and severity
Lost user funds: ETH silently miscredited to the wrong account [E2](https://bugbountylibrary.com/r/cantina%3Asize_february2025%3A3.1.3.md). Severity rises when the misdirection is silent and the payer's own deposit still appears to succeed.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AH-07.md
- E2: https://bugbountylibrary.com/r/cantina%3Asize_february2025%3A3.1.3.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-16.md