Reproduced Exploit
Maia DAO — User may underpay for remote call ExecutionGas (missing Anycall premium)
1. _payExecutionGas deposits gasprice gas only.\n2. Anycall charges (gasprice+premium)gas.\n3. Gap taken from other users shared executionBudget.
Chain
Other
Category
untagged
Date
May 2023
Source
AuditVault
EVM Playground
Source-level debugger — step opcodes and Solidity in sync
The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.
Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 26048-h-14-user-may-underpay-for-the-remote-call-executiongas-on-t. Standalone Foundry PoC and full write-up: 26048-h-14-user-may-underpay-for-the-remote-call-executiongas-on-t_exp in the
evm-hack-registrymirror.
Vulnerability classes: see taxonomy below
Reproduction: a self-contained Foundry PoC that compiles & runs in an isolated project with only
forge-std— no fork, no RPC, noanvil_state. Full trace: output.txt. PoC: test/26048-h-14-user-may-underpay-for-the-remote-call-executiongas-on-t_exp.sol.
Key info#
| Impact | HIGH — minExecCost omits premium; Anycall charges gasprice+premium; premium gap drains shared execution budget |
| Protocol | Maia DAO |
| Finding | Code4rena · reporter xuwinnie |
| Report | https://code4rena.com/reports/2023-05-maia |
| Source | AuditVault |
| Status | Audit finding — reproduced as a standalone local PoC. |
| Compiler | ^0.8.24 (PoC) |
This is an audit finding, not a historical on-chain incident.
TL;DR#
- _payExecutionGas deposits gasprice * gas only.\n2. Anycall charges (gasprice+premium)*gas.\n3. Gap taken from other users shared executionBudget.
Diagrams#
Impact#
minExecCost omits premium; Anycall charges gasprice+premium; premium gap drains shared execution budget
Sources#
- AuditVault finding
- Code4rena report
- Reduced synthetic:
test/26048-h-14-user-may-underpay-for-the-remote-call-executiongas-on-t.sol(C2 local-deploy)
Sources & further analysis#
Reproductions & code
- Standalone PoC + full trace: 26048-h-14-user-may-underpay-for-the-remote-call-executiongas-on-t_exp (evm-hack-registry mirror).
- AuditVault finding: 26048-h-14-user-may-underpay-for-the-remote-call-executiongas-on-t.
Alerts & third-party analyses
These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.