Lack of logic for blacklisted addresses.
Summary
When using tokens with blacklisting feature, the Escrow contract lacks of logic for handling blacklisted addresses.
Vulnerability Details
It's so common to use USDC as tokenContract, which has blacklisting feature.
This issue comes severe especially when dispute happens.
When either buyer or seller disagrees with the counterparty, or the arbiter goes malicious, they can make their address blacklisted so that no one can receive tokens back.
Impact
Tokens will be strained into smart contract and won't be able to withdraw.
Tools Used
Brain, Remix
Recommendations
When dispute happens and token transfer fails, it should not revert but handle different logic.
For example, when token transfer fails to the arbiter, share tokens between buyer/seller, and when either buyer/seller is blacklisted to receive token, counterparty receives the remaining amount.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.