First Flight #13: Baba Marta

Summary

In MartenitsaMarketplace::buyMartenitsa function if the msg.value > listing.price i.e user sends more ether than the listing price then the extra ether is permanently stuck in the contract since it has now way to withdraw ether.

Impact

Extra Funds which the users may send while buying MartenitsaToken are permanently stuck in the contract.

Proof of Concept

let listing.price = 2 ether

1. User calls MartenitsaMarketplace::buyMartenitsa with msg.value = 10 ether

2. The extra 8 ether is permanently stuck in the MartenitsaMarketplace contract with no way to withdraw or recover it.

Recommendations

There are two possible mitigations for this issue

1. Making the changes in the MartenitsaMarketplace::buyMartenitsa function accordingly

which sends only required ether to the contract which makes the contract hold no extra ether.

2. Alternatively, consider Adding a MartenitsaMarketplacewithdraw function where the contract owner and other users can withdraw their funds also make sure that the new function follows the CEI(Checks-effects-Interactions) pattern and has necessary guards in place like OpenZeppelinReentrancyGuard