CodeHawks Escrow Contract - Competition Details

Summary

Add methods to add arbiter in existing Escrow contracts

Vulnerability Details

If the Escrow contract gets created without the arbiter, and if an arbiter is needed to settle a dispute, then there is no way to add one.

Impact

The only way to get funds our of the contract is:

• Case 1: Buyer is satisfied and so they use confirmReceipt() method to send funds to the seller

• Case 2: There is a dispute, and there is a need for an arbiter to resolve the dispute.

For Case 2, the funds cannot be taken out of the contract in case of disputes, and so the funds get locked in there.

Severity Justification

Marking this as medium as both the following medium criteria satisfy:

• Funds are indirectly at risk

• Disruption of protocol functionality or availability

Source: https://docs.codehawks.com/rewards-and-judging

Tools Used

Manual analysis

Recommendations

Create a method that can update the arbiter if needed. This method can be written such that both the buyer and seller agree to add the arbiter based on their votes.