# _getBeneficiaryFromCalldata(...) in ConnextRouter should not allow the first action to be depositETH(...) Low/Info · Three Sigma · Lending aggregator · 6th May, 2023 Finding 3S-FUJI-L08 of the Fuji Finance security review. - Report: /reports/fuji-finance - Source: https://cdn.sanity.io/files/qoqld077/staging/32181a28eac3175d15fb8924d249bb0d91ca350c.pdf --- ### Description Currently issue 3S-FUJI-M07 means that the deposit action can't be performed on a cross transfer at all. Still, having fixed it, the first action should not be depositETH(...), as there is no ETH to be deposited yet (unless users are using the balance of the ConnextRouter in the other chain, which should not be intended). ### Recommendation In _getBeneficiaryFromCalldata(...), revert if the first action is depositETH(...). Flashloans would not be able to call depositETH(...) in the first action, which is okay because they send ERC20s anyway. ### Status Addressed here: [Fujicracy/fuji-v2#650](https://github.com/Fujicracy/fuji-v2/pull/650) --- Related findings: - [Withdrawing after a slash event before the vault has ended will decrease `fixedSidestETHOnStartCapacity` by less than it should, so following users will withdraw more their initial deposit](https://0xsimao.com/findings/saffron-lido-vaults-slash-eth-withdraw-deposit): Saffron Lido Vaults - [mTapiocaOFT can't be rebalanced because the Balancer in tapiocaz-audit calls swapETH() or swap() of the RouterETH but does not forward ether for the message fee](https://0xsimao.com/findings/tapioca-dao-rebalanced-balancer-eth-fee): Tapioca DAO