DittoETH

Summary

BridgeReth missing 'correct' minimum amount check on its depositETH

Vulnerability Details

Rocket Pool implement a minimum required ETH to be deposited in their pool, rocketDAOProtocolSettingsDeposit.getMinimumDeposit() and this check is missing on BridgeReth contract.

Yes, in BridgeRouter there is a minimum deposit

but that value (as information from discord) is to prevent a dust amount, as we can see this following constant value.

Meanwhile, from rocketpool docs, their minimum amount is 0.01 ETH

Thus, I believe this getMinimumDeposit() check should be applied, when someday the minimum is increased to for example 0.015 ETH, the DittoETH protocol can automatically adjust accordingly.

Moreover, there is also a maximum deposit allowed, getMaximumDepositPoolSize() which can be helpful to add, but is not an issue compare to the minimum amount check.

Impact

User deposit will be reverted but may not knowing due to rETH min deposit is not checked

Tools Used

Manual analysis

Recommendations

consider add the rocketDAOProtocolSettingsDeposit.getMinimumDeposit() check on rETH depositETH