[Lines of code](https://github.com/debtdao/Line-of-Credit/blob/6987988fe39901cad9a8e5ebb2c6aa719590873d/contracts/modules/credit/LineOfCredit.sol#L223-L244) # Vulnerability details Impact All payable functions [addCredit()](), [increaseCredit()](), [depositAndClose()](), [depositAndRepay()](), [close()](). in [LineOfCredit](https://github.com/debtdao/Line-of-Credit/blob/master/contracts/modules/credit/LineOfCredit.sol) do not refund if: * the caller sends Ethers but token is not set to Denominators.ETH * the caller sends Ethers in excess (msg.value > amount) Moreover the [LineOfCredit](https://github.com/debtdao/Line-of-Credit/blob/master/contracts/modules/credit/LineOfCredit.sol>) contract does not have a "post-mortem" way to withdraw and return excess Ethers from the contract as the only 3 functions that can transfer Ethers outside of the contract are [borrow()](), [withdraw()](), and [_close()]( ## Tools Used n/a ## Recommended Mitigation Steps Add some error handling to [addCredit()](), [increaseCredit](https://github.com/debtdao/Line-of-Credit/blob/6987988fe39901cad9a8e5ebb2c6aa719590873d/contracts/modules/credit/LineOfCredit.sol#L265-L285>), [depositAndClose()](), [depositAndRepay()](), [close()](). in [LineOfCredit]( amount) { (bool success, ) = payable(msg.sender).call{value:(msg.value - amount)}(""); require(success, "Address: unable to send value, recipient may have reverted"); } Only exception is with the [close()]() function where at the very end of the function (requires Checks-Effects-Interactions pattern), the following can be added: if(token == Denominators.ETH && msg.value > facilityFee) { (bool success, ) = payable(msg.sender).call{value:(msg.value - facilityFee)}(""); require(success, "Address: unable to send value, recipient may have reverted"); } --- The text was updated successfully, but these errors were encountered: All reactions

Query Builder