excess eth passed to LineOfCredit is stuck

[code423n4]

Lines of code

https://github.com/debtdao/Line-of-Credit/blob/master/contracts/utils/LineLib.sol#L71

Vulnerability details

Impact

excess eth sent to LineOfCredit is stuck in the contract. SecuredLine and SpigotedLine both have a sweep that can eventually release the eth. But this kind of applies to them too as it requires the debit to be repaid or only the arbiter can retrieve them.

Proof of Concept

PoC test in LineOfCredit.t.sol

    function test_credit_position_ETH_to_much_sent() public {
        assertEq(address(line).balance, 0, "Line balance should be 0");
        assertEq(lender.balance, mintAmount, "lender should have initial mint balance");
        console.log(lender.balance);
        hoax(borrower);
        line.addCredit(dRate, fRate, 1 ether, Denominations.ETH, lender);

        vm.startPrank(lender);
        line.addCredit{value: 2 ether}(dRate, fRate, 1 ether, Denominations.ETH, lender);
        vm.stopPrank();
        console.log(lender.balance);
        bytes32 id = line.ids(0);
        assert(id != bytes32(0));
        assertEq(address(line).balance, 2 ether, "Line balance should be 1e18");
        assertEq(lender.balance, mintAmount - 2 ether, "Lender should have initial mint balance minus 1e18");

        vm.startPrank(lender);
        // line.withdraw(id,2 ether); fails
        line.withdraw(id,1 ether);
        assertEq(address(line).balance, 1 ether, "Line balance should be 1e18");
        
        // line.withdraw(id,1 ether); fails
        vm.stopPrank();
    }

Tools Used

vscode, forge

Recommended Mitigation Steps

change:

diff --git a/contracts/utils/LineLib.sol b/contracts/utils/LineLib.sol
index fb112cb..62fc7f8 100644
--- a/contracts/utils/LineLib.sol
+++ b/contracts/utils/LineLib.sol
@@ -68,7 +68,7 @@ library LineLib {
         if(token != Denominations.ETH) { // ERC20
             IERC20(token).safeTransferFrom(sender, address(this), amount);
         } else { // ETH
-            if(msg.value < amount) { revert TransferFailed(); }
+            if(msg.value != amount) { revert TransferFailed(); } 
         }
         return true;
     }

There's never any reason to send more eth than stated in amount to the contract.

[c4-judge]

dmvt marked the issue as duplicate of #25

[c4-judge]

dmvt marked the issue as satisfactory

[C4-Staff]

liveactionllama marked the issue as duplicate of #39