THE WETH TRANSFER VIA THE `L1WethBridge` COULD GET `DoS` IF THE DEPOSIT AMOUNT REACHES THE `limitData.depositCap` LIMIT SINCE `s.totalDepositedAmountPerUser[_depositor]` VALUE IS NOT CORRECTLY UPDATED FOR FAILED DEPOSIT TRANSACTIONS WHEN FINALIZING ON L2
Audit: 2023-10-zksync-findings
Severity: MEDIUM

# Lines of code

https://github.com/code-423n4/2023-10-zksync/blob/main/code/contracts/ethereum/contracts/bridge/L1WethBridge.sol#L185
https://github.com/code-423n4/2023-10-zksync/blob/main/code/contracts/ethereum/contracts/zksync/facets/Mailbox.sol#L261
https://github.com/code-423n4/2023-10-zksync/blob/main/code/contracts/ethereum/contracts/zksync/facets/Mailbox.sol#L275-L281


# Vulnerability details

## Impact

The `L1WethBridge.deposit` function is used to `initiate a WETH deposit` by depositing WETH into the L1 bridge contract, `unwrapping` it to `ETH` and sending it to the `L2 bridge contract` where ETH will be `wrapped again` to `WETH` and sent to the `L2 recipient`.

The `deposit` function calls the `zkSync.requestL2Transaction` function to construct the `L2 transaction` by passing to it the `msg.value` and this `L2 transaction` will be executed in L2 zkSync.

The `Mailbox.sol` contract implements the `requestL2Transaction` function and in its function execution verifies the deposit limit as shown below:

        _verifyDepositLimit(msg.sender, msg.value);

And the logic implementation of the `_verifyDepositLimit` function is as follows:

    function _verifyDepositLimit(address _depositor, uint256 _amount) internal {
        IAllowList.Deposit memory limitData = IAllowList(s.allowList).getTokenDepositLimitData(address(0)); // address(0) denotes the ETH
        if (!limitData.depositLimitation) return; // no deposit limitation is placed for ETH

        require(s.totalDepositedAmountPerUser[_depositor] + _amount <= limitData.depositCap, "d2");
        s.totalDepositedAmountPerUser[_depositor] += _amount;
    }

As shown above the `_verifyDepositLimit` function ensures that the `deposited Eth amount` by the `L1WethBridge` contract via the `Mailbox` does not exceed the `limitData.depositCap` limit. 

But the issue here is that if the initiated `L1->L2 Weth deposit` fails when finalizing on L2, the `s.totalDepositedAmountPerUser[_depositor]` (here _depositor is the `L1WethBridge`) storage variable for the deposited `Eth value` by the `L1WethBridge` is not updated by reducing the failed deposit amount from the `s.totalDepositedAmountPerUser[_depositor]` mapping for the `L1WethBridge` address.

Now let's consider the following scenario: 

1. Let's assume that the current `limitData.depositCap` is 1000 Eth.
2. Currently there is `900 Eth` deposited via the `L1WethBridge` contract. Which means the s.totalDepositedAmountPerUser[L1WethBridge] == 900 Eth.
3. User A wants to send `80 Weth` to the `l2 receiver` User B.
4. Hence he initiates the `Weth` transfer via the `L1WethBridge.deposit` function.
5. Now the `s.totalDepositedAmountPerUser[L1WethBridge]` is updated to `980 Eth`. (Assume the gas amount is negligble)
6. But the deposit fails when finalizing on L2. 
7. Hence the deposit refund recipient address will receive the deposited Eth amount.
8. But the `User B` the expected L2 receiver did not receive the Weth amount.
9. Now the `User A` tries