Summary

The contract EscrowFactory.sol does not check if the buyer address and the arbiter address are the same. The buyer can take advantage of disputes by resolving them in his/her favour.

Vulnerability Details

If the buyer creates an escrow contract with their address equal to arbiter address they can resolve the dispute giving them their initial tokens placed in the contract, as well as the assets sent by the seller involved in the dispute.

Impact

Loss of funds to the seller as they will not receive the funds they were expecting while attempting to resolve the dispute. As long as buyerAward > 0 and the award set is token Balance of the contract, the buyer will receive their initial deposit as well as the assets sent by the seller.

Tools Used

Manual review

Recommendations

Ensure the buyer is unable to take advantage of disputes by validating the did not set themselves as the arbiter in Esscow.sol
if (buyer == arbiter) revert();