Submission Details
Severity:
`arbiter` is not checked for the zero address.
Summary
arbiter in the constructor is not checked for the zero address.
Vulnerability Details
The lack of zero address validation for arbiter allows it to be set to the zero address (0x0).
constructor(
uint256 price,
IERC20 tokenContract,
address buyer,
address seller,
address arbiter,//@audit no check for address(0x0)
uint256 arbiterFee
) {
if (address(tokenContract) == address(0)) revert Escrow__TokenZeroAddress();
if (buyer == address(0)) revert Escrow__BuyerZeroAddress();
if (seller == address(0)) revert Escrow__SellerZeroAddress();
if (arbiterFee >= price) revert Escrow__FeeExceedsPrice(price, arbiterFee);
if (tokenContract.balanceOf(address(this)) < price) revert Escrow__MustDeployWithTokenBalance();
i_price = price;
i_tokenContract = tokenContract;
i_buyer = buyer;
i_seller = seller;
i_arbiter = arbiter;
i_arbiterFee = arbiterFee;
}
Impact
arbiter can become address(0x0)
Tools Used
Manual review
Recommendations
Add zero address validation for arbiter, similar to how you have done for buyer and seller in the constructor.
Prize pool breakdown
Total prize
40,000 USDC
nSLOC
186215 USDC / LOC
37,000 USDC
3,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.