CodeHawks Escrow Contract - Competition Details

Summary

The contract assumes that the user has approved their tokens for the contract, while generally safe to assume, it is unsafe since some non-native defi users can easily assume approving the contract means sending the contract your tokens, like we've seen before with many examples.

Vulnerability Details

could lead to stuck tokens in escrow factory contract

Impact

loss of funds

Tools Used

manual review

Recommendations

add an approve call at the beginning of the contract, approving the amount price from the callers balance