Both resolveDispute
and confirmReceipt
depend on safeTransfer to succeed, since there are many erc20 tokens variants as well as other variants that can make these functions misbehave, or at best be DOS'd
either state transition functions can constantly revert depending on the safeTransfer, potential Dos, or simple ERC20 variants that behave unexpectedly.
can render a smart contract unusable, or at worst, a malicious token owner can blacklist the seller and forbid the arbiter from resolving a dispute. Rendering the contract to favor their outcome.
Manual review
consider splitting critical state transitions into one function, that updates balance to each corresponding user with, and allowing each user to withdraw their tokens separately, in that case the enum state.Completed
can be re-used so that it updates to completed once 3/3 withdrawals are confirmed
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.