First Flight #13: Baba Marta

Summary

Dust amount of ether is locked in MartenitsaMarketplace contract as there is no function in the contract that can send the remaining amount.

Vulnerability Details

When users buy the MartenitsaToken using buyMartenitsa function, they can send ether more than the actual price listed in the listing. In such cases where users have bought MartenitsaTokens using more than the required amount, there will be small amounts of ether left in the contract. But there is no function available in the contract with which owner can withdraw the leftover amount, therefore, locking the remaining amount of ether in contract forever.

Impact

The remaining amount of ether will be left in the contract forever without any way to retrieve it.

Tools Used

Manual Review

Recommendations

MartenitsaMarketplace contract should contain a withdraw function with which owner of the contract can withdraw the dust amount of ether left in the contract.