CodeHawks Escrow Contract - Competition Details

Summary

If an actor sends more funds than they wanted, they can't change it, which can cause loss of funds

Vulnerability Details

The buyer makes an Escrow contract and sends 1000 usdc
But they only want to charge 100 usdc so assuming there is an arbiter,they can dispute. Disputing also comes with an arbiter fee so which makes this code path not optimal and loss of opportunity for the buyer
ex:
The buyer makes Escrow and sends 1000 usdc
they initiateDispute
The arbiter calls resolveDispute and (ex:arbtierFee=2 usdc)
the buyer(protocol) will only get back 898
Let's say we have an honest arbiter and they give the fee back this can cost a lot of gas on mainnet more than the fee or they don't give the fee because it still can be honest because code is law

Impact

causing a loss for the buyer and the Escrow not having an optimal way to deal with this edge case

Tools Used

Recommendations

keep track of balance in a var instead of account.balance.In a safe way allow the protocol to take out the extra funds.