CodeHawks Escrow Contract - Competition Details

Summary

Seller can never do audit, once escrow is created. Because of that buyer have to loose arbiter fee.

Vulnerability Details

Once escrow is created, then only funds that are transferred are provided by buyer.
It's possible that auditor will never do the job and as result buyer will have to pay arbiter fee in order to receieve back paid funds.

I believe that it's incorrect and another approach should be implemented. There should be a penalty in case if auditor does nothing. And this penalty amount should be deposited by auditor and it will be paid to arbiter in case if auditor didn't do the job.
Otherwise, that amount will be transferred back to auditor, when contract is finished.

Impact

Buyer losses funds, when auditor do not do the job.

Tools Used

VsCode

Recommendations

Add penalty deposit.