DittoETH

Summary

Fail attempt to withdraw, unstake and withdrawTapp while interacting with Bridge Faucet Router due to the eth conversion overflow revert.

Vulnerability Details

The protocol will update the yield only after the total amount of zeth is 1000 eth or 1.6 million dollars which is very high and also the amount to be working with is 1 percent of it which is 16000 dollars minimum. In these scenerio, if the amount becomes 400 ETH or higher by any rich user/whale (which is expected in this protocol), and the total zeth becomes 1000000 or higher, then the withdraw, unstake, and withdrawTapp will revert as the ethConversion function will revert.

Impact

This will not let the rich users/old users with much amount in their account of ditto to withdraw them instantly. And they have to make multiple transactions to do that.

Tools Used

manual review

Recommendations

This should be breaked into multiple steps. Using upcasting while multiplying(to avoid overflow), and then downcasting after the division.