CodeHawks Escrow Contract - Competition Details

Summary

Buyer can collude with Arbiter so Seller get nothing (0)

Vulnerability Details

The Buyer can collude with the Arbiter in the resolveDispute process (set buyerAward = price - arbiterFee) --> this means the Seller will get 0 out of it, and the Buyer will get price - arbiterFee , which can be shared with the Arbiter as incentive to pull this off.

To make the attack happen, the Buyer just needs to initiateDispute and colludes with the Arbiter to resolve the dispute dishonestly (and share the rewards)

Impact

Seller (auditors) may not get paid.

Tools Used

Manual Review

Recommendations

• Add enough incentive for the Arbiter to not behave dishonestly (if you think the Arbiter is fully trusted, then we shouldn't need this escrow contract at all and just let Arbiter decide who gets what), OR

• Add enough penalty in case the Buyer misbehave, OR

• Put the disputed tokens in Timelock contract, where withdrawals are delayed, and let the governance or the DAO vote in case some dishonest things happened.