40,000 USDC
View results
Submission Details
Severity: low
Valid

Arbiter can be equal to buyer/seller

Summary

The Arbiter should, by definition, be a third party for resolving disputes. However it is possible, that it is equal to the seller or buyer.

Vulnerability Details

In the Escrows Constructor there is no check if the arbiter equals the buyer or seller address. If the arbiter is set to the same address as either the buyer or the seller, there is a centralization risk on this one party, as they can get all the funds out of the escrow to themselves by initiating a dispute and resolving it to themselves.

Impact

One party can get all the funds, bypassing the actual escrow functionality.

Tools Used

Recommendations

Add a check in the constructor to verify the arbiter is not the buyer or seller address.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.