Submission Details
Severity:
Use nonce as args to create new escrow
Summary
Vulnerability Details
The factory contract will revert if two different contracts are created with the same args(different salt).
Impact
Unable to deploy different contracts with the same args.
Tools Used
Manual Review.
POC
function testFailedDeployTwoEscrow() public {
vm.startPrank(BUYER);
ERC20Mock(address(i_tokenContract)).mint(BUYER, PRICE * 2);
ERC20Mock(address(i_tokenContract)).approve(
address(escrowFactory),
PRICE * 2
);
escrow = escrowFactory.newEscrow(
PRICE,
i_tokenContract,
SELLER,
ARBITER,
ARBITER_FEE,
SALT1
);
vm.stopPrank();
assertEq(escrow.getPrice(), PRICE);
assertEq(address(escrow.getTokenContract()), address(i_tokenContract));
vm.startPrank(BUYER);
vm.expectRevert();
escrow = escrowFactory.newEscrow(
PRICE,
i_tokenContract,
SELLER,
ARBITER,
ARBITER_FEE,
SALT1
);
vm.stopPrank();
}
Recommendations
Use nonce to deploy the escrow. It will make sure that not only the contract with the same args are able to be deployed but also be able to easily track the number of escrows created through the nonce.
Prize pool breakdown
Total prize
40,000 USDC
nSLOC
186215 USDC / LOC
37,000 USDC
3,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.