Submitted by __141345__, also found by 0xSmartContract, joestakey, rbserver, datapunk, eierina, bin2chen, Tomo, 0xbepresent, aphak5010, and cloudjunky
If ERC20 and eth are transferred at same time, the mistakenly sent eth will be locked.
There are several functions that could be affected and cause user fund lock:
In receiveTokenOrETH(), different logic is used to handle ERC20 and eth transfer. However, in the ERC20 if block, mistakenly sent eth will be ignored. This part of eth will be locked in the contract.
In the ERC20 part, add check for msg.value to ensure no eth is sent:
kibagateaux (Debt DAO) confirmed
