Summary

When buyer calls confirmReceipt function, he transfer all of the token inside the contract to the Seller.

Vulnerability Details

There are two instances of it:

1. No checks are done to make sure that Seller would get only price that is set inside i_price variable.

2. In resolveDispute function

Impact

If some tokens are transferred to the contract mistakenly, then the seller would get all of the amount inside the contract.

Here is the link to test that proofs it:
test 1 : test 1 for confirmReceipt

test 2 : test 2 for resolveDispute

Tools Used

foundry tests

Recommendations

Instead of sending all tokens to the seller, send only i_price amount. Rest of the token should be transferred back to the buyer or any other address that fits the situation.

Here is the example:

1. for confirmReceipt: example

2. for resolveDispute: example

Here is the test:

1. For confirmReceipt: test

2. For resolveDispute: test