Summary

The current design allows the selection of an arbiter on contract creation. The buyer then has the power to choose an arbiter under the control (even an EOA). And whenever they receive the service, they raise a dispute and immediately resolve it through resolveDispute() to get all the funds back plus the service.

Vulnerability Details

Impact

This breaks the whole point of the protocol.

Tools Used

Recommendations

The selection of the arbiter should be a separate step between the buyer and the seller. A voting flow could be used to allow for collaboration between the two parties for the choice of the arbiter.