Summary

If the arbiter is set to either the buyer or the seller this would result in a unfair result in case the escrow is disputed

Vulnerability Details

In the constructor of Escorw.sol there is no check to ensure that the input arbiter is neither the seller nor the buyer. This opens the possibility for the buyer to put himself as the arbiter and hope that the seller does not notice it. Once the audit is over the buyer can dispute the escrow and refund himself all tokens. Also if the buyer puts the seller as the arbiter by accident this would put him at a disadvantage if the escrow gets disputed.

Impact

If the buyer puts himself as the arbiter without the seller noticing, he can refund himself the escrow tokens once the audit is over and the seller does not get paid.

Tools Used

Manual review

Recommendations

Add a check in the constructor of Escrow.sol to ensure the arbiter is neither the buyer nor the seller