receiveTokenOrETH() MAY LOCK ETHER SENT TO THE CONTRACT, FOREVER

[code423n4]

Lines of code

https://github.com/debtdao/Line-of-Credit/blob/6987988fe39901cad9a8e5ebb2c6aa719590873d/contracts/utils/LineLib.sol#L59

Vulnerability details

Impact

receiveTokenOrETH() receives funds. However, there is code path within the function that does not require Ether. Ether passed to the function, when the non-Ether code path is taken, is locked in the contract forever, and the sender gets nothing extra in return for it.

Proof of Concept

If ETH is provided for a ERC20 credit line, it would not be accounted for, thus lost forever to the user. msg.value shouldn’t be provided here:

if(token != Denominations.ETH) { // ERC20 @audit add require(msg.value==0);
    IERC20(token).safeTransferFrom(sender, address(this), amount);
} 

Tools Used

VSCode

Recommended Mitigation Steps

Add a require(0 == msg.value) for the above three conditions.

[c4-judge]

dmvt marked the issue as duplicate of #25

[c4-judge]

dmvt marked the issue as partial-25

[c4-judge]

dmvt marked the issue as not a duplicate

[c4-judge]

dmvt marked the issue as duplicate of #89

[c4-judge]

dmvt marked the issue as partial-25

[C4-Staff]

liveactionllama marked the issue as duplicate of #355