CodeHawks Escrow Contract - Competition Details
Cyfrin
Foundry
40,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

[H-02] Prevent i_arbiter from being initialized with address (0)

pina

Summary

The i_arbiter address can be initialized like address(0) and is possible for a DOS.

Vulnerability Details

The i_arbiter is not evaluated in the constructor, but the evaluation is in initiateDispute(). So, if for some reason the buyer and the seller do not reach an agreement, it is not possible to create a dispute and the fund may be blocked.
The buyer may forget to initialize the arbiter(default is address(0) and execute the transaction and lose the funds.

Impact

The have impact on the buyer or seller for receive the payment or refund.

Tools Used

Manual code review

Recommendations

You can mitigate this vulnerability by moving these sentences to the constructor. How that :

if (address(tokenContract) == address(0)) revert Escrow__TokenZeroAddress();
if (buyer == address(0)) revert Escrow__BuyerZeroAddress();
if (seller == address(0)) revert Escrow__SellerZeroAddress();
+ if (i_arbiter == address(0)) revert Escrow__DisputeRequiresArbiter();

and update initiateDispute()

function initiateDispute() external onlyBuyerOrSeller inState(State.Created) {
- if (i_arbiter == address(0)) revert Escrow__DisputeRequiresArbiter();
s_state = State.Disputed;
emit Disputed(msg.sender);
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.