CodeHawks Escrow Contract - Competition Details
Cyfrin
Foundry
40,000 USDC
View results
Previous Next
Submission Details
Severity: low

`EscrowFactory` should store deployed `Escrow` addresses.

Bobface

Summary

EscrowFactory should store deployed Escrow addresses.

Vulnerability Details

The EscrowFactory deploys the Escrow contracts in function newEscrow. It only returns the resulting address from the function and emits an EscrowCreated event, however, it does not store the address in a storage variable.

Impact

The opposite party, i.e., the one that has not deployed the contract, will want to verify that the Escrow has in fact been deployed by the factory to avoid being scammed. Doing so, however, is not trivial with the current design, and would require manually analyzing the deploy transaction or to scan past events emitted by the factory.

Tools Used

None

Recommendations

Store deployed addresses in a mapping:

contract EscrowFactory is IEscrowFactory {
// ...
mapping(IEscrow => bool) public deployed;
function newEscrow(
// ...
) external returns (IEscrow) {
// ...
deployed[escrow] = true;
emit EscrowCreated(address(escrow), msg.sender, seller, arbiter);
return escrow;
}

This allows each party to call deployed(escrow) to verify that a given escrow address has been deployed by the factory easily.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.