DittoETH

Summary

minimum deposit should be checked based on zethAmount, because comparing Constants.MIN_DEPOSIT with amount and msg.value may not be equal price. thus the minimum constraint here is different.

Vulnerability Details

In BridgeRouter when deposit through deposit() and depositEth() there is a minimum amount check as following:

this assume the amount and msg.value does have same value vector (assuming ETH and LST is 1:1). But that's not always true.

Rather than comparing the minimum with the input amount or msg.value, it's understandable to
check or compare with zethAmount returned from the amount or msg.value converted.

Impact

Different minimum amount of zeth for deposit via deposit() or depositEth()

Tools Used

Manual analysis

Recommendations

The check should be using the converted zeth amount rather than amount or msg.value inputted