Summary

When using tokens with blacklisting feature, the Escrow contract lacks of logic for handling blacklisted addresses.

Vulnerability Details

It's so common to use USDC as tokenContract, which has blacklisting feature.
This issue comes severe especially when dispute happens.
When either buyer or seller disagrees with the counterparty, or the arbiter goes malicious, they can make their address blacklisted so that no one can receive tokens back.

Impact

Tokens will be strained into smart contract and won't be able to withdraw.

Tools Used

Brain, Remix

Recommendations

When dispute happens and token transfer fails, it should not revert but handle different logic.
For example, when token transfer fails to the arbiter, share tokens between buyer/seller, and when either buyer/seller is blacklisted to receive token, counterparty receives the remaining amount.