Summary

Escrow contract lack of Deadline / Timeout can lead to seller didn't get their payout after deliver the work

Vulnerability Details

Including a deadline or expiration time in an escrow contract is a common practice. The deadline sets a time limit for the parties to fulfill their obligations. If the required actions are not completed within the given timeframe, predefined actions are triggered, such as refunding funds to the sender or releasing them to the recipient.

The inclusion of a deadline ensures that the escrow process is time-bound, providing certainty to the parties involved. It prevents indefinite holds on funds and ensures that the escrowed assets are either released or refunded within a specific timeframe. This time constraint is particularly useful in scenarios where there may be delays or disputes in fulfilling the escrow agreement.

In cases where no arbiter is involved, the seller may not be guaranteed to receive the payout amount, as the buyer could withhold the funds intentionally or unintentionally. To prevent this issue, implementing a deadline lock time is necessary. The deadline lock time ensures that the funds are released or refunded even if an arbiter is not present, safeguarding the interests of both parties and promoting a more secure and efficient escrow process.

In my experience with Web2 freelance marketplaces like Fiverr, when both the buyer and seller agree on a task, payment amount, and duration of work, there is a subsequent timeout for the buyer to 'accept' or 'approve' the delivery after the seller fulfills their task and delivers the results. If the buyer accepts the delivery within the timeout period, the funds are released to the seller as agreed.

However, there are instances when the buyer ignores the 'accept or approve' option, either due to dissatisfaction or lack of attention. Because of the timeout, the funds are automatically released to the seller by default when it expires. This can be similar to an Escrow situation without such a timeout, where non-finalized tasks can result in the seller's payout being indefinitely on hold.

To address this issue, introducing a timeout mechanism in the Escrow contract is essential. By setting a specific timeframe for the buyer to 'accept' or 'approve' the delivery, we can prevent the funds from being indefinitely locked and ensure that the seller receives their payout in a timely manner. This improvement would enhance the reliability of the Escrow process and provide a more efficient experience for both parties involved.

for example:

Impact

When no arbiter involved, seller payout will be locked unlimited time when buyer failed to release the fund (intentionally or unintentionally)

Tools Used

Manual analysis

Recommendations

Implement a deadline or timeout of this Escrow process. The predefined action can be triggered when its due. This predefined can be refunding to buyer, or releasing to seller, it depends on agreement.