# Not handling the failure of cross chain messaging

Renzo's L1 xReceive reverts on depositETH failures (TVL cap, pause, zero mint), silently stranding bridged L2 funds with no retry path.

- Payout: Contest reward
- Severity: medium
- Program: Renzo
- Credited: fyamf
- Disclosed: 2024-06-07
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-04-renzo-findings/issues/373
- Library page: https://bugbountylibrary.com/r/c4%3A2024-04-renzo%3AM-08
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Cross-chain bridge receiver (xRenzoBridge.xReceive) and L2 xRenzoDeposit
**Root cause:** xReceive calls restakeManager.depositETH without try/catch, so any revert (MaxTVLReached, paused, InvalidTokenAmount) aborts the Connext receive and leaves funds on the receiver with no retry.
**Steps:**
1. On L2, call `xRenzoDeposit.deposit`/`depositETH` to mint xezETH and trigger a Connext bridge message to L1.
2. Cause L1 `xReceive` to revert: deposit pushes `totalTVL + collateralTokenValue > maxDepositTVL` (e.g. flash-loan WETH on L2), or L1 `RestakeManager` is paused, or `renzoOracle.calculateMintAmount` returns 0 (`InvalidTokenAmount`).
3. Observe Connext delivers funds to `xRenzoBridge` but `xReceive` reverts; no automatic retry for receiver reverts.
4. Funds remain stuck on the receiver; admin must manually recover and redistribute.
**How found:** Read Connext failure-handling docs noting receiver reverts strand funds, then traced xReceive -> depositETH -> deposit/calculateMintAmount revert paths (TVL cap, pause, zero mint) and L2 lacking pause/TVL checks.
**Exploitation:** Attacker flash-loans WETH, deposits on L2 to mint xezETH, swaps xezETH to repay the loan; the bridged message reverts on L1 due to maxDepositTVL, stranding the bridged WETH on xRenzoBridge.
**Insight:** For any IXReceiver implementation, enumerate every revert path in the receive handler (caps, pause flags, zero-amount math) and check whether the messaging layer retries receiver reverts; if not, wrap in try/catch with an authenticated recovery path.