Summary

It's kind of a risk to rely on a single Arbitier to resolve the dispute when your funds are locked in the Contract.

Vulnerability Details

When a dispute is started only Arbitier can call resolveDispute() to release the funds for buyer and seller. However we cannot be 100% sure the Arbitier will be in touch with a team during this process. Moreover he can lost his access to the account or run into any other human problem, like become sick. So the fund will be locked.

Impact

Funds can be lock for a long period of time. So even if buyer place a valid Arbitier during contract creation, his funds could be locked.

Tools Used

Manual review

Recommendations

It's better to limit the duspute time for some period, like 2-3 days. Or provide several accounts in an array for the Arbitier role.