CodeHawks Escrow Contract - Competition Details
Cyfrin
Foundry
40,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Tokens with Blocklist as USDC can prevent Seller or Arbiter from obtaining the funds.

talfao

Summary

USDC token is implementing admin owned blocklist, which prevents users from sending/obtaining funds in this Token.

Vulnerability Details

In case when SELLER or ARBITER does not know that they are not USDC blocklist, it can happen shortly before creating an Escrow. There is no check for this kind of blocklist in the escrow contract. The funds get stuck in Escrow.

I add here this vulnerability as USDC is a commonly used token, and also it was told that it will be used in Escrows.

Impact

Escrow does not check if the Seller or Arbiter occurs on this blocklist. It will prevent the Seller or Arbiter from obtaining the funds.

Proof of concept

I created a Simple POC to imagine this situation, where I took some functionality from Escrow to test to have it in one place. The test below prevents confirmReceipt functionality as the seller is in blocklist.

mapping(address => bool) public blacklist;
​
function blackList(address addr) public returns (bool) {
return blacklist[addr];
}
​
function transfer(address to) internal {
if (blackList(to)) {
revert("User blacklisted");
}
ERC20Mock(address(i_tokenContract)).mint(SELLER, PRICE);
}
​
function testBlacklisted() public {
blacklist[SELLER] = true;
vm.startPrank(BUYER);
ERC20Mock(address(i_tokenContract)).mint(BUYER, PRICE);
ERC20Mock(address(i_tokenContract)).approve(
address(escrowFactory),
PRICE
);
escrow = escrowFactory.newEscrow(
PRICE,
i_tokenContract,
SELLER,
ARBITER,
ARBITER_FEE,
SALT1
);
vm.stopPrank();
// This test contract is Escrow
ERC20Mock(address(i_tokenContract)).mint(address(this), PRICE);
transfer(SELLER); // This is going to revert
}

Tools Used

Manual review.

Recommendations

Add check for blocklist if the Token which is used in Escrow is USDC in the constructor of Escrow.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.