CodeHawks Escrow Contract - Competition Details
Cyfrin
Foundry
40,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Conflicts of Interest due to Same Buyer, Seller, and Arbiter Addresses

devanas

Summary

The vulnerability in the escrow contract occurs when the addresses of the buyer, seller, and arbiter are set to the same. This results in a lack of an impartial arbiter, compromising the fairness and security of the escrow arrangement.

Vulnerability Details

In the Escrow contract, during deployment, there is a missing validation check to ensure that the addresses of the buyer, seller, and arbiter are unique. As a result, if these addresses are set to the same value, the contract proceeds without detecting the conflict of interest.

Here's the test suit:

// an address that will be set to the buyer, seller and arbiter.
address sameAddress = vm.addr(1);
​
function testWhenBuyerAndSellerAndArbiterAreSame() public {
vm.startPrank(sameAddress);
ERC20Mock(address(i_tokenContract)).mint(sameAddress, PRICE);
ERC20Mock(address(i_tokenContract)).approve(
address(escrowFactory),
PRICE
);
escrow = escrowFactory.newEscrow(
PRICE,
i_tokenContract,
sameAddress,
sameAddress,
ARBITER_FEE,
SALT1
);
vm.stopPrank();
assertEq(escrow.getPrice(), PRICE);
assertEq(address(escrow.getTokenContract()), address(i_tokenContract));
​
assertEq(escrow.getBuyer(), sameAddress);
assertEq(escrow.getSeller(), sameAddress);
assertEq(escrow.getArbiter(), sameAddress);
assertEq(escrow.getArbiterFee(), ARBITER_FEE);
}

Impact

The impact of this vulnerability is significant. When all roles have the same address, there is no neutral party to mediate disputes between the buyer and seller. This can lead to conflicts, biased decisions, and potential misuse of power, ultimately jeopardizing the funds and assets involved in the transaction. The lack of an impartial arbiter also hinders proper dispute resolution, leaving both parties vulnerable to fraud and unfair practices.

Tools Used

Manual Review

Recommendations

To address this vulnerability, it is crucial to add a validation check during contract deployment to ensure that the buyer, seller, and arbiter addresses are unique. By enforcing this requirement, the escrow contract can maintain the impartiality of the arbiter and provide a fair and secure environment for conducting transactions. Additionally, users and developers should exercise caution when deploying escrow contracts and avoid using the same address for multiple roles to mitigate the risks associated with this vulnerability.

We can add the if statement to check that all address are unique:

// Check that all addresses (buyer, seller, and arbiter) are unique
if (buyer == seller || buyer == arbiter || seller == arbiter) {
revert Escrow__BuyerSellerAndArbiterNotUnique();
}
​

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.