Upgraded Q -> 2 from #57 [1716796622913]

[c4-judge]

Judge has assessed an item in Issue #57 as 2 risk. The relevant finding follows:

3, Fee are not able to be claimed in xRenzoDeposit when aassset is not WETH

[alcueca]

@jatinj615, please review.

Full text of the issue here.

[s1n1st3r01]

Hey @alcueca

I believe this is invalid

The depositToken the warden is referring to in the code snippet above, is always set to be the address of WETH, and not anything else. This is also mentioned in the natspec of the initialize() function of xRenzoDeposit

• @param _depositToken WETH on L2

function _recoverBridgeFee() internal {
    uint256 feeCollected = bridgeFeeCollected;
    bridgeFeeCollected = 0;
    // transfer collected fee to bridgeSweeper
    uint256 balanceBefore = address(this).balance;
    IWeth(address(depositToken)).withdraw(feeCollected);  // <--- depositToken is always WETH
    feeCollected = address(this).balance - balanceBefore;
    (bool success, ) = payable(msg.sender).call{ value: feeCollected }("");
    if (!success) revert TransferFailed();
    emit SweeperBridgeFeeCollected(msg.sender, feeCollected);
}

Therefore the warden's claim that this function will revert if the depositToken is not WETH is not true. It will always be WETH.

---

In xRenzoDeposit, you have two functions:

• deposit(). This is a function where you deposit depositToken which is WETH. Function then proceeds to trade it with nextWETH and the rest of the flow goes on.
• depositETH(). This is a function where you can deposit ETH instead of WETH. What this function does is that it wraps the ETH into WETH, and the rest of the flow goes on (trading WETH with nextWETH and so on..)

[deeplake31337]

From document link, it mentioned that 'The xRenzoDeposit contract mints $ezETH tokens in response to wETH or LST deposits'. So deposit token can be other token address to be able to interact with LSTs.

[jatinj615]

On L2s, only WETH and ETH deposits are supported.

For the L2s where ETH is not native. For ex - BSC, the contract just sends the collected WETH to sweeper instead of WETH::withdraw.

[c4-judge]

This auto-generated issue was withdrawn by alcueca

[c4-judge]

alcueca marked the issue as grade-b

[alcueca]

Downgrading to QA, and the sponsor should be clearer in the intention of the code.