DittoETH

Summary

The depositEth function is marked as payable but does not properly handle surplus ether above a certain threshold. This could result in the loss of ether for users sending more ether than intended.

Vulnerability Details

In the depositEth function, there is a vulnerability related to handling surplus ether sent by users. The function is marked as payable, which allows users to send ether to it. However, it checks whether the msg.value is less than Constants.MIN_DEPOSIT, and if this condition is not met, it reverts with an "UnderMinimumDeposit" error.

The issue is that if a user sends more ether than Constants.MIN_DEPOSIT, the surplus ether is not returned or refunded to the sender. This can lead to the unintended loss of ether, as there is no mechanism in place to handle the excess funds.

Impact

The impact of this issue is financial in nature. Users who accidentally or intentionally send more ether than the specified minimum deposit may lose the surplus ether, as it is not properly handled or refunded by the contract. This can result in a loss of funds and an unsatisfactory user experience.

Tools Used

Manual Review

Recommendations

Refund Excess Ether: Modify the depositEth function to refund any excess ether sent by the user above the Constants.MIN_DEPOSIT. You can use the payable function's msg.sender.transfer() method to refund the surplus ether.