Submitted by Ruhum, also found by 0x1f8b and pauliax
The BathBuddy contract is able to receive ETH. But, theres no way of ever retrieving that ETH from the contract. The funds will be locked up.
Currently, there seems to be no logic in the protocol where ETH is sent to the contract. But, it might happen in the future. So Id say its a MED issue.
receive()  function: https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/peripheral_contracts/BathBuddy.sol#L69
Remove the receive() function if the contract isnt supposed to handle ETH. Otherwise, add the necessary logic to release the ETH it gets.
bghughes (Rubicon) confirmed
