CodeHawks Escrow Contract - Competition Details

Summary

The current architecture of the Escrow contract is such that the actors i.e., buyer, seller and arbiter have to query the smart contract for state changes.

Vulnerability Details

The protocol lacks the robustness that is required for the actors involved to respond to the state changes in the contract.

Consider the example where the seller calls the initiateDispute function, now both the buyer and arbiter are unaware of this change, unless they query the smart contract or communicate off-chain. Once the arbiter is aware of this and calls resovleDispute, both the buyer and seller are unaware of this as well. Overall, this provides a bad user interface.

The missing link to resolve the issue is using a decentralized notification protocol like PUSH.

Impact

Bad User Experience

Tools Used

Manual Analysis

Recommendations

Use the PUSH protocol to notify the buyer, seller and arbiter about important function calls like confirmReceipt, initiateDispute, resolveDispute

PUSH docs - https://docs.push.org/epns-smart-contracts/