DittoETH

Summary

Updated MIN check and new MAX check required in BridgeRouterFacet.sol::depositEth(), which calls depositEth() in both of the bridge contracts; BridgeReth.sol and BridgeSteth.sol. The staking protocols these bridge contracts interact with both implement deposit limits which should be aligned to.

Assumptions

Assumed that the DittoEth has merged functions from two of Lido.fi protocol's contracts into one mock contract given that the submit() function used in BridgeSteth.sol::depositEth() comes from Lido.sol contract and other functions come from StETH.sol. In recommendations I continue to use this assumption for simplicity.

Vulnerability Details

BridgeRouterFacet.sol

There is a minimum deposit check in BridgeRouterFacet.sol::depositEth() which is 0.0001 ether which is not high enough.

BridgeReth.sol

rocketDepositPool.sol::deposit() implements a minimum value of 0.01 ether defined at RocketDAOProtocolSettingsDeposit.sol#L18 and used at RocketDepositPool.sol#L94 (see links).
It further implements a dynamic maximum allowed value, depending on current conditions, and is checked in the code block at RocketDAOProtocolSettingsDeposit.sol#L107-L117 (linked). The checks in the code block are activated if msg.value is greater than 160 ether.

BridgeSteth.sol

No minimum allowed value.
The maximum allowed value in Lido.sol::submit() is dynamic, depending on considerations such as network conditions and protocol needs. The staking limit is checked in the code block at Lido.sol#L930-L936 (linked). The checks in the code block will be activated if isStakingLimitSet is true.

Impact

BridgeReth.sol

Any deposit below allowed minimum 0.01 ether or above current allowed maximum will cause the transaction to revert. This means the user's transaction will fail and user will lose the gas costs associated with that transaction and user will have bad user experience.

BridgeSteth.sol

Any deposit above current allowed maximum will cause the transaction to revert. This means the user's transaction will fail and user will lose the gas costs associated with that transaction and user will have bad user experience.

Tools Used

Manual Review

Recommendations

Constants.sol

Increase minimum deposit stored at Constants.MIN_DEPOSIT to 0.01 ether to match BridgeReth.sol

BridgeReth.sol

Update BridgeReth.sol::depositEth() to include:

• A maximum check, using rocketDepositPool::getMaximumDepositAmount(), that msg.value does not breach current allowed maximum.

BridgeSteth.sol

Update BridgeSteth.sol::depositEth() to include:

• A maximum check, using Lido.sol::getCurrentStakeLimit() (linked), that msg.value does not breach current
  allowed maximum.