First Flight #13: Baba Marta

Summary

There is no logic to prevent relisting a tokenId that is already listed for sale.

Vulnerability Details

In MartenitsaMarketplace.sol, listMartenitsaForSale() has no logic to prevent relisting a tokenId that is already listed for sale. A malicious actor can:

1. List a tokenId for sale.

2. Wait for a buyer to buy at a certain price.

3. Frontrun the buy transaction, relisting the same tokenId at a higher price.

Notice in buyMartenitsa(), msg.value >= listing.price tolerates sending value greater than the listed price and potentially overpay for a token.

Impact

Potential financial loss for users.

Tools Used

Manual review.

Recommendations

• Add logic to prevent relisting atokenId that is already listed for sale.

• require(msg.value == listing.price, "Insufficient funds");