Protocol fees from execution layer rewards will be lost

[howlbot-integration]

Lines of code

https://github.com/code-423n4/2024-04-renzo/blob/1c7cc4e632564349b204b4b5e5f494c9b0bc631d/contracts/Deposits/DepositQueue.sol#L160

Vulnerability details

Vulnerability Detail

The DepositQueue contract states the following regarding the receive() function:

/// This should receive ETH from scenarios like Execution Layer Rewards and MEV from native staking

However, Execution layer rewards are sent by directly increasing the contract's balance without calling the receive() function.

This means that when rewards are accrued the following logic within the receive() function will not execute:

1. Protocol fee collection
2. Filling of WithdrawalQueue buffer
3. Incrementing the value at totalEarned[address(0x0)]

Impact

The protocol does not receive fees from execution layer rewards, which is a major disruption to protocol functionality. Also, the WithdrawalQueue is not prioritised leading to a potential state of inability to withdraw.

Proof of Concept

receive() function

https://github.com/code-423n4/2024-04-renzo/blob/1c7cc4e632564349b204b4b5e5f494c9b0bc631d/contracts/Deposits/DepositQueue.sol#L160

Tools Used

Manual Review

Recommended Mitigation

Ensure that rewards are sent to a different contract, not DepositQueue as it is stated in the comments.

Assessed type

Error

[C4-Staff]

CloudEllie marked the issue as duplicate of #498

[c4-judge]

alcueca changed the severity to QA (Quality Assurance)

[c4-judge]

alcueca marked the issue as grade-a