Submission Details
Severity:
No access control in creation of Escrow contracts
Summary
There is no access control to limit who can deploy Escrow contracts via the factory. Any Ethereum address could deploy.
Vulnerability Details
In newEscrow(), there is no access control.
function newEscrow(
uint256 price,
IERC20 tokenContract,
address seller,
address arbiter,
uint256 arbiterFee,
bytes32 salt
) external returns (IEscrow) {
Impact
Anyone could make an Escrow contract
Tools Used
Manual code review
Recommendations
Add a Access Control mechanism to limit the number of addresses to create an Escrow contract
Prize pool breakdown
Total prize
40,000 USDC
nSLOC
186215 USDC / LOC
37,000 USDC
3,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.