ETH can be accidentally sent with ERC20 in sendOutTokenOrETH function

[code423n4]

Lines of code

https://github.com/debtdao/Line-of-Credit/blob/audit/code4rena-2022-11-03/contracts/utils/LineLib.sol#L34-L51

Vulnerability details

Impact

ETH can be accidentally sent with ERC20 in sendOutTokenOrETH function

User who wants to send ERC20 due to payable function can write a value in the value field

Proof of Concept

contracts/utils/LineLib.sol:
  33       */
  34:     function sendOutTokenOrETH(
  35:       address token,
  36:       address receiver,
  37:       uint256 amount
  38:     )
  39:       external
  40:       returns (bool)
  41:     {
  42:         if(token == address(0)) { revert TransferFailed(); }
  43:         
  44:         // both branches revert if call failed
  45:         if(token!= Denominations.ETH) { // ERC20
  46:             IERC20(token).safeTransfer(receiver, amount);
  47:         } else { // ETH
  48:             payable(receiver).transfer(amount);
  49:         }
  50:         return true;
  51:     }

Recommended Mitigation Steps

ETH can be sent by mistake with ERC20 in sendOutTokenOrETH function, it is enough to add a simple require to prevent this

[c4-judge]

dmvt marked the issue as duplicate of #89

[c4-judge]

dmvt marked the issue as partial-50

[C4-Staff]

liveactionllama marked the issue as duplicate of #355