# Metadata is not set in Cap, which is required by the inherited Router to specify gas limit to the mailbox Medium · Three Sigma · Cross-chain liquidity layer 1 · 25th June, 2024 Finding 3S-Mitosis-M02 of the Mitosis security review. - Protocol: https://mitosis.org/ - Report: /reports/mitosis - Source: https://cdn.sanity.io/files/qoqld077/production/b6b3bd7bb47407d99e76abb7c6dc615c1db5018e.pdf --- ### Description The gas limit of messages must be set in the metadata [function](https://github.com/hyperlane-xyz/hyperlane-monorepo/blob/0865c948c378253b462d7be4fa33cd6e3d504cf0/solidity/contracts/client/MailboxClient.sol#L95-L99), as indicated by the [docs](https://docs.hyperlane.xyz/docs/reference/hooks/interchain-gas#gas-limit). When it is not set, the gas limit defaults to 50_000, which may not be enough to handle the epoch increase on the destination. ### Recommendation Overwrite the function with the correct metadata. Additionally, the Hyperlane version used is old, consider using a more recent one. In the newer version, metadata is sent as an argument, which makes it more obvious that it must be set. ### Status Addressed in [#669b422](https://github.com/mitosis-org/evm/pull/209/commits/669b42290ee61125b3a3a2cc89260ae25c117301#diff-921fe5b309152434d034bb27db30835bf2302846ca4c3dc1a21e9c3214d13eb6). --- Related findings: - [Attackers can claim deposits to vaults if users specify the router as receiver and don't withdraw shares after](https://0xsimao.com/findings/fuji-finance-deposits-specify-withdraw-shares): Fuji Finance - [_crossTransfer(...) should revert if users specify routerByDomain[destDomain] as destination](https://0xsimao.com/findings/fuji-finance-transfer-revert-specify-dest): Fuji Finance - [Send should revert if the gas limit has not been set for a destination chain (peer)](https://0xsimao.com/findings/metazero-i-revert-gas-destination-peer): MetaZero Omnichain NFTs - [`uniTransfer()` limits the gas limit to 5k in outdated 1inch solidity-utils lib](https://0xsimao.com/findings/1inch-uni-transfer-gas-1inch): 1inch Fee Extension