Summary

Escrow can be created without arbiter. In that case funds can be stucked.

Vulnerability Details

When Escrow is created, then there is no check that arbiter is provided.

In this case, dispute will be not possible. And this means that auditor now fully depends on buyer. As if buyer will not confirm receipt, then auditor did job for free. While for buyer there is no loss(except reputation) here, as he don't receive funds in any way.

Impact

Funds can be stucked.

Tools Used

VsCode

Recommendations

Add additional check that arbiter was provided.