Users can drain Gelato deposit at little cost
In Console automation, fees are collected via the `claimExecutionFees()` modifier:\\n```\\n   modifier claimExecutionFees(address _wallet) {\\n     uint256 startGas = gasleft();\\n  _;\\n if (feeMultiplier > 0) {\\n    address feeToken = FeePayer._feeToken(_wallet);\\n      uint256 gasUsed = startGas -gasleft();\\n       (uint256 feeAmount, address recipient, Types.Executable memory feeTransferTxn)=FeePayer._buildFeeExecutable\\n         (gasUsed, feeToken);\\n emit FeeClaimed(_wallet, feeToken, feeAmount);\\n   if (feeToken != ETH) {uint256 initialBalance = IERC20(feeToken).balanceOf(recipient);_\\n       executeSafeERC20Transfer(_wallet, feeTransferTxn);\\n             if (IERC20(feeToken).balanceOf(recipient) -initialBalance < feeAmount){\\n        revert UnsuccessfulFeeTransfer(_wallet, feeToken);}\\n     } else {\\n    uint256 initialBalance = recipient.balance;\\n  Executor._executeOnWallet(_wallet, feeTransferTxn);\\n if (recipient.balance -initialBalance < feeAmount) {\\n      revert UnsuccessfulFeeTransfer(_wallet, feeToken);\\n                }\\n            }\\n        }\\n    }\\n```\\n
When calculating fees in buildFeeExecutable(), there are assumptions about the gas cost of an ERC20 transfer and a native transfer.\\n```\\n    // Keeper network overhead -150k\\n      uint256 internal constant GAS_OVERHEAD_NATIVE = 150_000 + 40_000;\\n        uint256 internal constant GAS_OVERHEAD_ERC20 = 150_000 + 90_000;\\n```\\n\\nA good fix would be to check the actual gas usage and require it to be under the hard cap.Team responseAdded a gas check for this attack.Mitigation reviewApplied fix has been applied.
```\\n   modifier claimExecutionFees(address _wallet) {\\n     uint256 startGas = gasleft();\\n  _;\\n if (feeMultiplier > 0) {\\n    address feeToken = FeePayer._feeToken(_wallet);\\n      uint256 gasUsed = startGas -gasleft();\\n       (uint256 feeAmount, address recipient, Types.Executable memory feeTransferTxn)=FeePayer._buildFeeExecutable\\n         (gasUsed, feeToken);\\n emit FeeClaimed(_wallet, feeToken, feeAmount);\\n   if (feeToken != ETH) {uint256 initialBalance = IERC20(feeToken).balanceOf(recipient);_\\n       executeSafeERC20Transfer(_wallet, feeTransferTxn);\\n             if (IERC20(feeToken).balanceOf(recipient) -initialBalance < feeAmount){\\n        revert UnsuccessfulFeeTransfer(_wallet, feeToken);}\\n     } else {\\n    uint256 initialBalance = recipient.balance;\\n  Executor._executeOnWallet(_wallet, feeTransferTxn);\\n if (recipient.balance -initialBalance < feeAmount) {\\n      revert UnsuccessfulFeeTransfer(_wallet, feeToken);\\n                }\\n            }\\n        }\\n    }\\n```\\n