CodeHawks Escrow Contract - Competition Details
Cyfrin
Foundry
40,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

The buyer can use a USDC/ USDT blacklist address to screw the auditor

tsvetanovv

Summary

The buyer can use a USDC/ USDT blacklist address to screw the auditor. Thus the auditor will have already done the audit but will not receive the reward for his work.

Vulnerability Details

In EscrowFactory.sol we have newEscrow():

function newEscrow(
uint256 price,
IERC20 tokenContract,
address seller,
address arbiter,
uint256 arbiterFee,
bytes32 salt
) external returns (IEscrow) {
address computedAddress = computeEscrowAddress(
type(Escrow).creationCode,
address(this),
uint256(salt),
price,
tokenContract,
msg.sender,
seller,
arbiter,
arbiterFee
);
tokenContract.safeTransferFrom(msg.sender, computedAddress, price);
Escrow escrow = new Escrow{salt: salt}(
price,
tokenContract,
msg.sender,
seller,
arbiter,
arbiterFee
);
if (address(escrow) != computedAddress) {
revert EscrowFactory__AddressesDiffer();
}
emit EscrowCreated(address(escrow), msg.sender, seller, arbiter);
return escrow;
}

This function is used to create a new Escrow contract. From the NatSpec we see.

///There is a risk that if a malicious token is used, the dispute process could be manipulated.

/// Therefore, careful consideration should be taken when chosing the token.

We see that care will be taken not to use a malicious token. But manipulation can also be done with trusted tokens.
Тhe most used stablecoin tokens USDC/USDT have contract level admin controlled address blacklist. If an address is blocked, then transfers to and from that address are forbidden.

Consider the following situation:

  • The buyer and seller agree on the price and the audit.

  • After the audit is done the buyer doesn't like something and doesn't want to pay.

  • So the seller(auditor) calls an arbitrator.

  • During this time, the buyer puts his address in blacklisted, and the resolveDispute() function cannot execute because reverts to the blacklisted address.

The above situation is quite possible even if the buyer has very good intentions but for some other reason, his addressee is added to the blacklisted address.

Impact

The auditor will not receive any reward for his work and the tokens will remain stuck.

Tools Used

Visual Studio Code

Recommendations

You can use pull over push model to transfer tokens.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.