In our version you're able to bid for each pixel -- if the previous owner is outbid, the funds are returned. Sending funds in Solidity from a contract is really tricky to handle because there are so many ways it can go wrong.
For example, when you send funds to an address, it can purposefully reject your payment and even call back into your own functions. This is like if when you called a REST API, the API was potentially malicious and could call any public function in your code (!).
This is a really fun project and it's cool to see how you can connect web-apps to the Ethereum network.