Submission Details
Severity:
Lack of zero address check when creating escrow
Summary
There is no zero address check when creating the escrow. The buyer can accidentally send fees to a zero address, and lose all his funds.
Vulnerability Details
When creating a new escrow, the buyer deposits his funds and inputs the seller address. However, he may accidentally input a zero address for both the arbiter and seller, and in that case, the buyer will lose all his funds because there is no way he can withdraw it back.
function newEscrow(
uint256 price,
IERC20 tokenContract,
address seller,
address arbiter,
uint256 arbiterFee,
bytes32 salt
) external returns (IEscrow) {
address computedAddress = computeEscrowAddress(
type(Escrow).creationCode,
address(this),
uint256(salt),
price,
tokenContract,
msg.sender,
seller,
arbiter,
arbiterFee
);
tokenContract.safeTransferFrom(msg.sender, computedAddress, price);
Impact
The buyer may lose his funds.
Tools Used
Manual Review
Recommendations
Add some zero address checks in the newEscrow function, eg
require(seller != address(0), "Seller is zero address");
Prize pool breakdown
Total prize
40,000 USDC
nSLOC
186215 USDC / LOC
37,000 USDC
3,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.