DittoETH

Summary

In BridgeRouterFacet contract users may lose funds due to unsafe downcasting to uint88 when calling deposit functions

Vulnerability Details

In deposit and depositEth function you make a call to Bridge contract and down cast the returned uint256 to uint88, in this case BridgeReth contract in its deposit function calls getEthValue function by passing the deposited amount in rocket ETH Token contract and returns the returned value, this function caculate the amount as follows:

if a user deposit large amount of tokens and the totalEthBalance value is bigger than rethSupply in rocket ETH Token contract the returned value may be greater than uint88 and when downcasting it, it will overflow and user's balance will be updated with 0 insted of the amount they actualy deposited and their funds will be lost

Impact

when downcasting Solidity will not revert but overflow, in this case it cause users loss if they deposit large amount of assets and market conditions has changed in rocket ETH token contract.

in comments it is mentioned this is safe cast but it is not since you don't use safe type casting (you shouldn't rely on luck)

(this vulnerability only exist for deposting assets using BridgeReth contract and not BridgeSeth contract since it returns the same inputed value and there is no external call for calculating the value)

POC

Tools Used

Manual Review

Recommendations

You can use SafeCast library from Openzeppelin for safe downcasting