# Borrower/Lender excessive ETH not refunded and permanently locked in protocol

Debt DAO's receiveTokenOrETH accepts msg.value > amount without refunding the excess, permanently locking overpaid ETH in LineOfCredit across five entry points.

- Payout: Contest reward
- Severity: medium
- Program: Debt DAO
- Credited: 0xdeadbeef0x
- Disclosed: 2023-02-07
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-11-debtdao-findings/issues/39
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-debtdao%3AM-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error

**Target:** LineOfCredit / LineLib receiveTokenOrETH ETH payment path
**Root cause:** receiveTokenOrETH only checks msg.value < amount and reverts; when msg.value > amount the surplus is added to contract balance but never recorded in internal accounting, and withdraw methods only pay out accounted amounts.
**Steps:**
1. Call addCredit{value: amount*2}(dRate, fRate, amount, ETH, lender) as lender after borrower's addCredit
2. Or call depositAndClose{value: amount*2}() / depositAndRepay{value: amount*2}(amount) / increaseCredit{value: amount*2}(id, amount)
3. Observe address(line).balance == amount*2 - amount after repayment/withdraw
4. Excess ETH remains in contract with no accounting entry and no withdrawal path
**How found:** Code review of LineLib.receiveTokenOrETH: noticed the ETH branch only reverts on underpayment (msg.value < amount) and never refunds or reverts on overpayment, then traced all callers (addCredit, increaseCredit, depositAndClose, depositAndRepay, close) and wrote Foundry tests asserting stuck balances.
**Exploitation:** User overpays ETH (by mistake or to cover accrued interest that changes per second); surplus is absorbed into contract balance, not tracked in accounting, and cannot be withdrawn by anyone.
**Insight:** In ETH-accepting contracts, audit every payable entry point for the msg.value == amount invariant; accrued-interest flows force callers to overpay, so any non-refunding receive path silently locks funds.