<p>This is Leni from Martify Labs. Thanks for using our contract!</p>
<p>So here the buyer initiates the transaction and therefore sees in his wallet popup exactly what is leaving his wallet before he signs and submits. The contract’s job is to verify that the seller got paid, that the project owners received their royalties and that the marketplace operators receive their fees. We also check that the buyer gets his NFT. If a malicious marketplace builds a transaction that takes additional funds from the buyer, the buyer would see it clearly and would not sign the tx.</p>
<p>We know that this falls to the responsibility of the buyer, but it’s the same when you buy an item on an online shop with your credit card. You check that the price asked to be paid corresponds to the item you are buying.</p>
<p>Also, we wrote this contract for it to be very simple so that it can be used as a learning tool and also offer good flexibility. Let’s say you want to modify it a bit to allow bulk purchases or sales, or to allow a “buy and create new sale immediately” feature. There you would need to remove the checks you are talking about because you don’t know what user might want to include in their transaction.</p>
<p>Hope this helps!</p>

CC BY-SA 4.0
2022-09-24T21:53:23.730Z
2022-09-24T22:00:03.990Z
2022-09-24T22:00:03.990Z
Alain Magazin
<p>I am some kinda embarrassed by &quot;mkBuyValidator&quot; in Martify <a href="https://github.com/MartifyLabs/martify.contracts/blob/main/src/Market/Onchain.hs" rel="nofollow noreferrer">Marketplace on-chain code</a> . For buyer there is only one check for token transfer (on line 68):
<code>(valueOf (valuePaidTo info sig) (nCurrency nfts) (nToken nfts) == 1)</code>.
And what about Ada amount or other funds that could be stolen from buyer in theory due to the fact of spending buyer's output (cause buyer is the signer)?</p>
<p>Am i right, that there should be some more checks?</p>

CC BY-SA 4.0
2022-09-20T21:37:33.727Z
Isn't that the responsibility of the buyer to verify before signing the transaction?
DaveStrider
CC BY-SA 4.0
2022-09-21T05:38:22.277Z
I suppose yes. However, don't sure about that stuff. As Ethereum developer, i d like to add some more checks. That's why asked the community :)
Anastasia Martyniuk
<plutus><on-chain><validator><security><validation>
Opportunity for theft of funds in Martify marketplace
# Opportunity for theft of funds in Martify marketplace

(Asked by: username_0 on 2022-09-20)

I am some kinda embarrassed by "mkBuyValidator" in Martify [Marketplace on-chain code](https://github.com/MartifyLabs/martify.contracts/blob/main/src/Market/Onchain.hs) . For buyer there is only one check for token transfer (on line 68):
`(valueOf (valuePaidTo info sig) (nCurrency nfts) (nToken nfts) == 1)`.
And what about Ada amount or other funds that could be stolen from buyer in theory due to the fact of spending buyer's output (cause buyer is the signer)?

Am i right, that there should be some more checks?

**Tags:** plutus, on-chain, validator, security, validation
> **Comments:**
> **username_1**: Isn't that the responsibility of the buyer to verify before signing the transaction?  
> **username_0**: I suppose yes. However, don't sure about that stuff. As Ethereum developer, i d like to add some more checks. That's why asked the community :)  

---

## 1 answers

### Answer by username_2 on 2022-09-24. Score: 0 | Accepted answer

This is Leni from Martify Labs. Thanks for using our contract!

So here the buyer initiates the transaction and therefore sees in his wallet popup exactly what is leaving his wallet before he signs and submits. The contract’s job is to verify that the seller got paid, that the project owners received their royalties and that the marketplace operators receive their fees. We also check that the buyer gets his NFT. If a malicious marketplace builds a transaction that takes additional funds from the buyer, the buyer would see it clearly and would not sign the tx.

We know that this falls to the responsibility of the buyer, but it’s the same when you buy an item on an online shop with your credit card. You check that the price asked to be paid corresponds to the item you are buying.

Also, we wrote this contract for it to be very simple so that it can be used as a learning tool and also offer good flexibility. Let’s say you want to modify it a bit to allow bulk purchases or sales, or to allow a “buy and create new sale immediately” feature. There you would need to remove the checks you are talking about because you don’t know what user might want to include in their transaction.

Hope this helps!


---

