DittoETH

Summary

The empty receive() function lack proper access control, potentially exposing the contract to unauthorized requests and the loss of funds. To enhance security, these functions should include appropriate access control checks or provide a means to recover unused Ether.

Vulnerability Details

https://github.com/Cyfrin/2023-09-ditto/blob/main/contracts/bridges/BridgeReth.sol#L37

These functions do not include any access control checks, which means that anyone can send Ether to the contract without proper authorization or any means to recover the funds. This lack of access control poses a risk as it can lead to the loss of Ether with no mechanism to retrieve it.

Impact

Anyone can send Ether to the contract without proper authorization or checks.
Users who send Ether to the contract may not have any way to retrieve their funds, leading to a potential loss of funds.

Tools Used

Manual Review