Summary

When creating a Escrow contract, there is a missing check which can result in buyer, seller and arbiter be the same address.

Vulnerability Details

The buyer invokes the newEscrow function, by passing some parameters to the function, As part of the function, we do check for address(0), but never check if buyer == arbiter.

This may not directly pose a security risk, But if an escrow contract is deployed where in if the the seller does not verify is buyer and arbiter are the same address, then once the service is provided, the buyer can call initiateDispute followed by resolveDispute and steal the PRICE amount set for the Escrow.

Impact

The seller may lose the escrow contract fee

Tools Used

Manual Analysis

Recommendations

Add a simple check in the Escrow contract's constructor to fix it.

The Fix