Excess ETH should be returned

[code423n4]

Lines of code

https://github.com/debtdao/Line-of-Credit/blob/audit/code4rena-2022-11-03/contracts/utils/LineLib.sol#L71

Vulnerability details

Impact

Only msg.value > amount is allowed here, but the excess(msg.value - amount) is not returned to the user.

Proof of Concept

    function receiveTokenOrETH(
      address token,
      address sender,
      uint256 amount
    )
      external
      returns (bool)
    {
        if(token == address(0)) { revert TransferFailed(); }
        if(token != Denominations.ETH) { // ERC20
            IERC20(token).safeTransferFrom(sender, address(this), amount);
        } else { // ETH
            if(msg.value < amount) { revert TransferFailed(); } // @audit  
        }
        return true;
    }

Tools Used

vscode

Recommended Mitigation Steps

payable(sender).transfer(msg.value - amout);

[c4-judge]

dmvt marked the issue as duplicate of #25

[c4-judge]

dmvt marked the issue as partial-50

[C4-Staff]

liveactionllama marked the issue as duplicate of #39