CodeHawks Escrow Contract - Competition Details
Cyfrin
Foundry
40,000 USDC
View results
Previous Next
Submission Details
Severity: high

Misuse of `resolveDispute` function in non-disputed state in `Escrow.sol contract

0xNiloy

Summary

The resolveDispute function in the Escrow contract is protected by the inState(State.Disputed) modifier, which reverts if the function is called when the contract is not in the Disputed state. However, if a malicious actor gains control over the arbiter's address, they could potentially call this function in a non-disputed state, leading to unexpected behavior and potential loss of funds.

Vulnerability Details

The resolveDispute function is designed to resolve disputes between the buyer and the seller. It is protected by the inState(State.Disputed) modifier, which ensures that the function can only be called when the contract is in the Disputed state. However, if a malicious actor gains control over the arbiter's address, they could potentially call this function when the contract is in a different state. This could lead to unexpected behavior, as the function transfers the remaining balance of the contract to the buyer, the arbiter, and the seller.

Code Snippet

function resolveDispute(uint256 buyerAward) external onlyArbiter nonReentrant inState(State.Disputed) {
uint256 tokenBalance = i_tokenContract.balanceOf(address(this));
uint256 totalFee = buyerAward + i_arbiterFee; // Reverts on overflow
if (totalFee > tokenBalance) {
revert Escrow__TotalFeeExceedsBalance(tokenBalance, totalFee);
}
​
s_state = State.Resolved;
emit Resolved(i_buyer, i_seller);
​
if (buyerAward > 0) {
i_tokenContract.safeTransfer(i_buyer, buyerAward);
}
if (i_arbiterFee > 0) {
i_tokenContract.safeTransfer(i_arbiter, i_arbiterFee);
}
tokenBalance = i_tokenContract.balanceOf(address(this));
if (tokenBalance > 0) {
i_tokenContract.safeTransfer(i_seller, tokenBalance);
}
}

Impact

If a malicious actor gains control over the arbiter's address and calls the resolveDispute function when the contract is in a non-disputed state, it could lead to unexpected transfers of the contract's balance. This could potentially result in a loss of funds for the buyer or the seller, and could undermine trust in the platform.

Tools Used

Manual code review

Recommendations

To mitigate this potential issue, it is recommended to add additional checks in the resolveDispute function to ensure that it can only be called when the contract is in the Disputed state. This could be implemented by adding a require statement at the beginning of the function, like so:

require(s_state == State.Disputed, "Contract must be in Disputed state to resolve dispute");

This would ensure that the resolveDispute function cannot be called when the contract is in a non-disputed state, thereby preventing the potential issues described above.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.