Submission Details
Severity:
Seller may receive 0 amount transferred when escrow is confirmed
Summary
Seller may receive 0 amount transferred when escrow is confirmed
Vulnerability Details
Price can be 0 when escrow is deployed. With the following if statement
if (tokenContract.balanceOf(address(this)) < price) revert Escrow__MustDeployWithTokenBalance();
escrow contract balance can be 0 when price is 0.
Assume there is no token transferred to the escrow contract, seller may not receive any amount when the contract is confirmed
function confirmReceipt() external onlyBuyer inState(State.Created) {
s_state = State.Confirmed;
emit Confirmed(i_seller);
i_tokenContract.safeTransfer(i_seller, i_tokenContract.balanceOf(address(this)));
}
This is because safeTransfer does allow zero amount transferred without throwing any error.
Impact
Seller receives nothing when escrow is confirmed
Tools Used
Manual
Recommendations
Ensure there is token balance when seller confirms the escrow
Prize pool breakdown
Total prize
40,000 USDC
nSLOC
186215 USDC / LOC
37,000 USDC
3,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.