DittoETH

Summary

Ether may be lost to the users who send in accidentally directly into contracts

Vulnerability Details

• BridgeReth.sol has an empty receive() function that is not necessary. If we look at other bridge contract BridgeSteth.sol it does not have a receive function. This receive can allow receiving in ether sent by error without crediting sender so the ether may be lost as there is no way to credit sender and send them back.

Impact

The impact of lost Ether is medium to high for user but given its a user error who must understand how to use the protocol overall risk may be considered LOW overall; however protocol used an unnecessary receive() so reporting it as Medium

Tools Used

Manual Analysis

Recommendations

Recommended to remove the receive() function in BridgeReth.sol to avoid direct Ether sends