Summary

The BridgeReth.sol contract is capable of receiving ETH through its receive() function, which is marked as payable. However, the contract lacks a corresponding mechanism to withdraw the received ETH. This oversight can lead to unintentional locking of funds within the contract.

Vulnerability Details

The BridgeReth.sol contract has a receive() function that can accept ETH, as it is marked as payable, unlike BridgeSteth.sol, which doesn't have it. This implies that users or other contracts can send ETH to this contract either intentionally or mistakenly.

However, there is no function or mechanism that allows for the withdrawal of this ETH. Even the unstake() function, which typically would be expected to handle such withdrawals, is not equipped to handle this scenario. The unstake() function only sends the netBalance, calculated as the difference between the contract's current balance and the originalBalance. This design oversight means that if ETH is sent to the contract, it might remain locked without any for retrieval.

Impact

Locked Funds: Any ETH sent to the contract, either intentionally or by mistake, will remain indefinitely locked, leading to financial loss for users.
Loss of Trust: Such design flaws can erode trust in the DittoEth protocol, making users hesitant to engage with it.

Recommendations

Remove the receive() function: Remove the function to avoid this issue.

Implement a withdrawEth() Function: Introduce a secure withdrawal function withdrawEth() in the BridgeReth.sol contract to allow the contract owner or designated parties to withdraw any ETH mistakenly sent to the contract.