CodeHawks Escrow Contract - Competition Details

Summary

As we see from Escrow contracts, each buyer has the option to choose an arbitrator who is trusted. But there is also an option not to choose. This is a measured risk that each buyer chooses, but in the event of a dispute, the funds may remain stuck in the contract.

Vulnerability Details

Here we have two options that can happen:

1 The buyer chooses the risk not to put an arbitrator because he trusts the seller(auditor). Subsequently, they do not get along the audit is not done. But let's say this option is semi-trusted because the seller may damage his reputation.

2 I want to pay special attention to the second option which I am sure will happen sooner or later:

• The buyer chooses an auditor with a great reputation and who is very good.

• The seller( top auditor) is also completely honest and would in no way screw the buyer or hurt his reputation.

• For this reason, there is no need for an arbitrator and because of the good qualities of the auditor (who is one of the best) it is possible that the amount paid for the audit is 6 figures.

• And here comes the situation where for a reason beyond the auditor's control the audit cannot be performed. In real life, anything can happen (for example, going into hospital and other bad or good things). No matter how much the auditor wants to there is no way to fulfill the audit. Then the buyer's funds are stuck in the contract.

Here we need to add some rescue() function under admin control to be able in such situations to return the funds to the buyer. Because the question here is not if such a situation will happen, but when it will happen.

Impact

The entire amount for the audit will remain stuck.

Tools Used

Visual Studio Code

Recommendations

Either make it mandatory to have an arbiter or add a rescue() function under the control of the admin or Escrow owner to be able to return funds to the buyer.