CodeHawks Escrow Contract - Competition Details
Cyfrin
Foundry
40,000 USDC
View results
Previous Next
Submission Details
Severity: gas

`EscrowFactory::newEscrow` salt argument does not provide any benefit in the current project context

abarbatei

Description

Project documentation states that:

In case a smart contract calls EscrowFactory::newEscrow, given that the caller of this contract is in control of the salt, frontrunning is a possibility.​

When an address is (pre)calculated using the same logic as create2, it is derived from a variety of inputs with the address of the sender as one of the them.

Escrow factory code:

address computedAddress = computeEscrowAddress(
type(Escrow).creationCode,
address(this),
uint256(salt),
price,
tokenContract,
msg.sender,
seller,
arbiter,
arbiterFee
);

While every other input in the computing of the address can be mimicked, msg.sender is the only one no attacker can replicate. As such, there will never be a possibility for a front-run attack to happen (by launching an escrow on the same address before hand).

Recommend Mitigation

Remove the salt parameter.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.