CodeHawks Escrow Contract - Competition Details

Summary

Certain types of tokens can break core logic.

Vulnerability Details

Any kind of weird tokens like FEE-ON-TRANSFER, rebasing and pausable tokens can cause breakage, logic flaws or off-chain misleading. Fee on transfer tokens can break the resolveDispute() function, since after a buyerAward is paid and the fee is transferred, the i_arbiterFee might become more than the token balance. This would force the arbiter to do more work and consensus for the dispute might not be reachable. A paused ERC20 can lock a dispute, thus locking the escrow. A rebasing token can confuse off-chain metrics.

Impact

Certain functions can be broken, or off-chain systems can receive wrong data.

Tools Used

Manual Review

Recommendations

Since currently, what kinds of tokens would be allowed is an unknown, I would suppose some kinds of tokens would not be vested, like pausable ones. If there's a case of an accepted FEE-ON-TRANSFER, there can be a check done for the before and after token balance and use it for comparison.