DittoETH

Summary

when the Bridge fee is more than the zethAmount then the user funds will be locked in the bridge.
they checked that if (amount < Constants.MIN_DEPOSIT) revert Errors.UnderMinimumDeposit(); it is useful for the protocal minimum deposit not the Bridge.
suppose this is the case that
amount > Constants.MIN_DEPOSIT
but amount < bridgefee then on that time user funds will be locked in the bridge.

Vulnerability Details

function withdraw(address bridge, uint88 zethAmount)
external
nonReentrant
onlyValidBridge(bridge)
{
if (zethAmount == 0) revert Errors.ParameterIsZero();

    uint88 fee;
    uint256 withdrawalFee = bridge.withdrawalFee();
    uint256 vault;
    if (bridge == rethBridge || bridge == stethBridge) {
        vault = Vault.CARBON;
    } else {
        vault = s.bridge[bridge].vault;
    }

    if (withdrawalFee > 0) {
        fee = zethAmount.mulU88(withdrawalFee);
        zethAmount -= fee;
        s.vaultUser[vault][address(this)].ethEscrowed += fee;
    }

    uint88 ethAmount = _ethConversion(vault, zethAmount);
    vault.removeZeth(zethAmount, fee);
    IBridge(bridge).withdraw(msg.sender, ethAmount);
    emit Events.Withdraw(bridge, msg.sender, zethAmount, fee);
}

https://github.com/Cyfrin/2023-09-ditto/blob/main/contracts/facets/BridgeRouterFacet.sol#L116-L140

in the above two functions when the bridge fee is more than the Constants.MIN_DEPOSIT funds will be locked in the bridge.

Impact

user funds will be locked in the bridge.

Tools Used

manual

Recommendations

check the bridge fee < zethAmount.