Summary

The Escrow contract contains a vulnerability that allows users to bypass the fund check during deployment by providing a price of 0. The bug circumvents the intended behavior of verifying that funds have been deposited to the contract's address before initialization.

Vulnerability Details

The Escrow contract's constructor includes a condition to ensure that tokens have been sent to this address during the contract deployment

If the user sets the price to 0, the condition becomes ineffective, as 0 is not greater than any balance, including 0. Consequently, the fund check is bypassed, allowing users to deploy the contract without sending any funds.

Impact

It violates the expected functionality of the escrow system. The severity of this bug is classified as "Low" because it does not directly compromise the security of the contract or user funds

Tools Used

Manual analysis

Recommendations

price>0