CodeHawks Escrow Contract - Competition Details

Summary

arbierFee can be set to 0, or very low amount, and in case of the dispute arbiter will get no reward for the job they are doing.

Vulnerability Details

Since buyer and seller need to agree on all the details, they can agree for arbiterFee to be set to 0. This will benefit them both if there is any dispute, they will loose less money that if arbiterFee is set to some normal amount.

There are no on-chain checks that will ensure that this fee is set appropriately, or that arbiter can decline the role if their compensation is not satisfying enough. Also, there are no mentions about this case (only about the case where fee is set too high) in the documentation or any mentions that this will be solved off-chain.

Impact

This forces arbiter to work for free, with no option to decline or set their fee in a fair manner, I consider this to be loss of money for arbiter and thus medium severity.

Tools Used

Manuel review

Recommendations

Implement minimum arbiterFee value, eg. x % of the price, either on-chain or off-chain.