No way to withdraw funds from `MartenitsaMarketplace`
Summary
Funds can be locked forever in the MartenitsaMarketplace contract, because there is no withdraw function.
Vulnerability Details
The buyMartenitsa::MartenitsaMarketplace.sol function, allows users to buy MT by sending eth to the contract. If a user sends more eth than the listed price of MT, the seller will receive the amount they listed their MT for and excess amount will be locked forever in the contract due to the absence of a withdraw function.
Impact
No way to withdraw funds from the contract, which means some eth can be locked inside forever.
Tools Used
Manual Review
Recommendations
Add a withdraw function, that the owner of the contract could use to retrieve the extra funds.
Lead Judging Commences
Excess ETH not refunded to the user
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.