Summary

Buyer can blacklist themselves on tokens like USDC to prevent payouts.

Vulnerability Details

The buyer has the power to call arbitration. When the escrow is in arbitration, an arbiter comes in and handles the payment amounts. This is shown in the following snippet.

This snippet depends on every transaction to go through. If say the transfer to the buyer, who is not trusted, reverts, it will prevent the arbitration of the entire escrow amount. If the buyer gets blacklisted, all transfer calls fail since it involves moving tokens to/from a blacklisted address. Thus if the buyer can successfully get blacklisted, they can prevent a payout.

Impact

Buyer can prevent payouts

Tools Used

Manual review

Recommendations

Add payments in try-catch blocks