CodeHawks Escrow Contract - Competition Details

Summary

In Escrowfactory there is an unneccessary cast from bytes32 to uint256.

Vulnerability Details

The function computeEscrowAddress takes the salt parameter as uint256. Therefore the salt, passed to newEscrow is casted to an uint256 from a bytes32 before passing it as an argument.
However there is no need for it to be an uint256 instead of bytes32, as it is only used inside a abi.encodePacked which is hashed.

Impact

Increased gas cost because of unneccessary type cast.

Tools Used

Manual Review

Recommendations

Change the computeEscrowAddress to take the salt as an bytes32 and remove the type cast.