Summary

The arbiter and buyer address could be the same.

Vulnerability Details

There is no check during creating a new Escrow to ensure that arbiter is not the same as buyer's address, so the buyer can profit from calling resolveDispute due to the high amount of buyerAward.

Impact

Arbiter (buyer) resolves the dispute with a high buyerAward amount so Seller gets a lower pay in comparison to what has been agreed on in the beginning.

Tools Used

Manual Review

Recommendations

Check that arbiter is not the same address as the buyer.