Renzo protocol Execution Layer Rewards are lost

[howlbot-integration]

Lines of code

https://github.com/code-423n4/2024-04-renzo/blob/main/contracts/Deposits/DepositQueue.sol#L163

Vulnerability details

Impact

In the contest details, the protocol mentions the following regarding Protocol Fees:

"Native ETH earned from outside EigenLayer (such as Execution Layer Rewards or MEV) will be sent to the DepositQueue receive() function. The protocol will then forward a configured fee percentage to an external address."

However, Execution Layer Rewards are not transferred, but rather credited. This means that the DepositQueue::receive() function will not trigger when these rewards are earned, and rewards will be lost.

Proof of Concept

DepositQueue::receive
https://github.com/code-423n4/2024-04-renzo/blob/main/contracts/Deposits/DepositQueue.sol#L163

    /// @dev Handle ETH sent to this contract from outside the protocol - e.g. rewards
    /// ETH will be stored here until used for a validator deposit
    /// This should receive ETH from scenarios like Execution Layer Rewards and MEV from native staking
    /// Users should NOT send ETH directly to this contract unless they want to donate to existing ezETH holders
    /// Checks the ETH withdraw Queue and fills up if required
    receive() external payable nonReentrant {
        uint256 feeAmount = 0;
        // Take protocol cut of rewards if enabled
        if (feeAddress != address(0x0) && feeBasisPoints > 0) {
            feeAmount = (msg.value * feeBasisPoints) / 10000;
            (bool success, ) = feeAddress.call{ value: feeAmount }("");
            if (!success) revert TransferFailed();

            emit ProtocolFeesPaid(IERC20(address(0x0)), feeAmount, feeAddress);
        }
        // update remaining rewards
        uint256 remainingRewards = msg.value - feeAmount;
        // Check and fill ETH withdraw buffer if required
        _checkAndFillETHWithdrawBuffer(remainingRewards);

        // Add to the total earned
        totalEarned[address(0x0)] = totalEarned[address(0x0)] + remainingRewards;

        // Emit the rewards event
        emit RewardsDeposited(IERC20(address(0x0)), remainingRewards);
    }

As we can observe from the function and dev comments, it is expected that this function will trigger when Execution Layer rewards are received.

However, that is not the case. Execution Layer Rewards are credited rather than transferred:

"Under proof of stake, the block reward is credited to the validator's beacon chain balance, and the transaction fees are credited to the fee_recipient Ethereum address".

Source: https://eth2book.info/capella/annotated-spec/#:~:text=fee_recipient%20is%20the,fee_recipient%20Ethereum%20address

The receive() function will not trigger and rewards will be lost.

Tools Used

Manual Review.

Recommended Mitigation Steps

Add a function to the DepositQueue contract to distribute Execution Layer rewards from the contract.

Assessed type

ETH-Transfer

[c4-judge]

alcueca changed the severity to QA (Quality Assurance)

[c4-judge]

alcueca marked the issue as grade-a