Summary

EscrowFactory should store deployed Escrow addresses.

Vulnerability Details

The EscrowFactory deploys the Escrow contracts in function newEscrow. It only returns the resulting address from the function and emits an EscrowCreated event, however, it does not store the address in a storage variable.

Impact

The opposite party, i.e., the one that has not deployed the contract, will want to verify that the Escrow has in fact been deployed by the factory to avoid being scammed. Doing so, however, is not trivial with the current design, and would require manually analyzing the deploy transaction or to scan past events emitted by the factory.

Tools Used

None

Recommendations

Store deployed addresses in a mapping:

This allows each party to call deployed(escrow) to verify that a given escrow address has been deployed by the factory easily.