CodeHawks Escrow Contract - Competition Details

Summary

If a dispute is needed and i_arbiterFee is equal to zero the arbiter could have no incentives to call resolveDispute to release and distribute the tokens stuck in the contract.

In this case, all the tokens will be stuck in the contract.

Vulnerability Details

If a dispute is needed and i_arbiterFee is equal to zero, the arbiter could have no incentives to call resolveDispute to release and distribute the tokens stuck in the contract.

In this case, all the tokens will be stuck in the contract.

Impact

Funds are "stuck" in the contract because arbiter has no incentives to work.

Tools Used

Manual

Recommendations

The arbiterFee input parameter of the Escrow.constructor should have a lower bound (proportional to the price) in order to incentive the Arbiter in case of a dispute.

Note that this scenario could be circumnavigated by a malicious buyer that could set up the Escrow to start with a "lower" price and then transfer tokens directly to the contract (via transfer or transferFrom).