CodeHawks Escrow Contract - Competition Details

Summary

A rational buyer will always call initiateDispute to receive free of charge checking from arbiter.

Vulnerability Details

Due to the i_arbiterFee included in the i_price it is absolutely free for the buyer to call initiateDispute for checking the results of seller's work. It is not the same with the known issue buyer never calls confirmReceipt, because any rational buyer will use this option. So if most of buyers work in this manner it will be impossible to separate malicious buyer from rational.

Impact

A seller will always receive less than i_price due to the dispute procedure.

Tools Used

Manual review.

Recommendations

I suggest returning 50% of i_arbiterFee to the buyer in the confirmReceipt function. This way the buyer will lose the same value as seller due to the dispute procedure. So the rational behavior for buyer will be to return some tokens and the rational behavior for seller will be to exclude any buyer's doubts to receive more tokens.