First Flight #13: Baba Marta

Summary

when a user buys a token with buyMartenitsa(), he can send more eth than actual price and that is not refunded.

Vulnerability Details

The problem arises in
require(msg.value >= listing.price, "Insufficient funds");
when a user accidentally sends more eth to buy a token ( or through bad front-end) as the diffference between msg.value and listing.price.

Impact

Loss of funds for user

Tools Used

Manual inspection

Recommendations

change requirement to
require(msg.value == listing.price, "Insufficient funds");