First Flight #13: Baba Marta

Summary

HeathTokens are stuck in MartenitsaEvent contract with no way to claim them.

Vulnerability Details

When users enter the MartenitsaEvent::joinEvent function to participate in the event, user's HeathTokens are transferred to MartenitsaEvent contract.
This contract does not have any method or function to retrieve or use these `HealthTokens, therefore, locking the HealthTokens in contract forever.

Impact

HealthTokens will be left in the contract forever without any way to retrieve or use them.

Tools Used

Manual Review

Recommendations

MartenitsaEvent contract should contain a withdraw function with which owner of the contract can withdraw or transfer the HealthTokens left in the contract.