CodeHawks Escrow Contract - Competition Details
Cyfrin
Foundry
40,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Funds can be stucked forever if there isn't an arbiter to initiate a dispute

darksnow

Summary

Funds are stucked forever if the buyer, for some reason (e.g. auditor didn't do his job, the auditor address is compromised, ...), doesn't want to pay the seller and there is no arbiter to initiate a dispute.

Vulnerability Details

There is the possibility to create an escrow without an arbiter because there are no checks in the constructor for address 0. If the buyer doesn't want to pay the seller the only way to retrieve his funds is by resolveDispute function setting the amount in buyerAward variable. However the dispute can only be initiated and then resolved if there is an arbiter.

Impact

Loss of funds.

Tools Used

Manual review.

Recommendations

Add a function to add an arbiter if needed.

address private _arbiter;
uint256 private _arbiterFee;
function addArbiter(address arbiter, uint256 arbiterFee) external onlyBuyer inState(State.Created) {
if (_arbiter != address(0)) revert Escrow__ArbiterAlreadySet();
if (arbiter == address(0)) revert Escrow__ArbiterZeroAddress();
_arbiter = arbiter;
_arbiterFee = arbiterFee;
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.