CodeHawks Escrow Contract - Competition Details
Cyfrin
Foundry
40,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Adding a Deadline Feature for Buyers in Escrow

pengun

Summary

If the seller (auditor) fails to provide the report for any reason and the arbiter is a null address, there is no method for the buyer to recover their funds from the escrow.

Vulnerability Details

When the arbiter is a null address, which can be a common occurrence as the arbiter role might not be preferred by sellers. The arbiter can be called upon to resolve disputes and adjust payouts, which sellers may view as unfavorable.

Buyer deposits funds that are to be released to the seller upon delivery of an agreed-upon service (in this case, an audit report). However, there's no mechanism for the buyer to retrieve their funds if the seller fails to deliver the report.

Impact

When arbiter is null address, buyer's funds can be locked in the escrow contract if the seller fails to deliver the report.

Tools Used

VS Code

Recommendations

Implement withdraw function with deadline.

function withdraw() external onlyBuyer inState(State.Created) {
if (i_deadline >= block.timestamp) revert Escrow__BeforeDeadline();
s_state = State.Withdrawn;
uint256 tokenBalance = i_tokenContract.balanceOf(address(this));
if (tokenBalance > 0) {
i_tokenContract.safeTransfer(i_buyer, tokenBalance);
}
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.