Debt DAO contest - lotux's results

Lines of code

https://github.com/debtdao/Line-of-Credit/blob/6987988fe39901cad9a8e5ebb2c6aa719590873d/contracts/modules/credit/LineOfCredit.sol#L237 https://github.com/debtdao/Line-of-Credit/blob/6987988fe39901cad9a8e5ebb2c6aa719590873d/contracts/modules/credit/LineOfCredit.sol#L280 https://github.com/debtdao/Line-of-Credit/blob/6987988fe39901cad9a8e5ebb2c6aa719590873d/contracts/utils/LineLib.sol#L71

Vulnerability details

Impact

The functions that deal with creating or adding credit take the "amount" parameter as input. However, the amount of currency to be deposited, in the case of choosing the ETH token, corresponds to the value of msg.value which may differ from the "amount" parameter. The receiveTokenOrETH function only checks that msg.value is less than amount but this allows msg.value to be greater than amount and therefore more funds than those actually associated with the lender are transferred.

Proof of Concept

https://github.com/debtdao/Line-of-Credit/blob/6987988fe39901cad9a8e5ebb2c6aa719590873d/contracts/modules/credit/LineOfCredit.sol#L237

https://github.com/debtdao/Line-of-Credit/blob/6987988fe39901cad9a8e5ebb2c6aa719590873d/contracts/modules/credit/LineOfCredit.sol#L280

https://github.com/debtdao/Line-of-Credit/blob/6987988fe39901cad9a8e5ebb2c6aa719590873d/contracts/utils/LineLib.sol#L71

Tools Used

VSCode

Recommended Mitigation Steps

changed LineLib.sol from:

            if(msg.value < amount) { revert TransferFailed(); }

into

            if(msg.value != amount) { revert TransferFailed(); }