Summary

The caller of EscrowFactory.newEscrow is considered the buyer. This is the address responsible for setting all other parameters. There are checks against zero address (except arbiter, which is expected), but the arbiter is not being forced to be different from the actual buyer.

Vulnerability Details

There is no check to prevent the arbiter from being the buyer address. A dispute raised by the seller is deemed irrelevant if the arbiter is the buyer, because the buyer can always resolve the dispute the way they want.

Impact

The function initiateDispute can be called both by the seller and the buyer. If the arbiter is the buyer, initiating a dispute is irrelevant for the seller. It renders the escrow functionality pointless.

Tools Used

Manual review.

Recommendations

Prevent the arbiter from being the same address as the buyer, either on the factory or on the actual Escrow contract.