Summary

resolveDispute function can transfer lesser funds to seller as a result of the use of balanceOf(address(this))

Vulnerability Details

The buyer and seller must have agreed on a fixed price. This is why the Escrow contract provided for i_price variabe. The getPrice function allows all the parties to see this price.

Now, where there is a dispute, the arbiter calls the resolveDispute function and sends funds to worthy parties. However, here's where the problem lies for the seller. The contract will transfer whatever amount that remains in the contract to the seller.

In a case where an arbiter ruled in favor of the seller, the seller will only receive amount remaining in the contract even if it is less than than the agreed upon price. It's possible the contract balance is not up to the agreed upon price. A seller can be at the receiving end here.

Also possible is a situation where the arbiter maliciously or mistaken sends buyerAward to the buyer, receives his own pre-agreed money, and send the balance of the contract to the seller - though the arbiter ruled all in favor of the seller.

The arbiter fee transferred to the arbiter is the pre-agreed "i_arbiterFee". The case of the seller shouldn't be different.

To be fair to a seller, in case of dispute, the agreed upon price (i_price) should be transferred to the seller where an arbiter rules in favor of the seller and not the contract balance. Transferring the contract balance to the seller is a big loop hole that can be exploited.

Impact

It's possible for a seller to receive less than the amount a seller is supposed to receive.

Tools Used

Manual review

Recommendations

The agreed upon price (i_price) should be transferred to the seller (not the contract balance) where an arbiter rules in seller's favor. The smart contract can also cover a situation where partial award is awarded to the seller where the seller is not entitled to the agreed price.