Summary

When dispute occurs the seller gets paid only when it is resolved. The amount is deducted from the paid amount but the checks are not done to insure that the amount transferred to the seller is correct.

Vulnerability Details

The arbiterFee and buyerAward is paid to arbiter and buyer from i_price amount. But if something happens and the contract get's drained some tokens then the amount paid to the user won't be enough.
This is where it could happen:


https://github.com/Aamirusmani1552/escrow-contract/blob/ac6439ca17fdb66d0cb6f414caceb7cc580e3400/src/Escrow.sol#L125

Impact

The Seller might not get paid enough.
Here are some tests:
Test with original contract Escrow.sol: test

Same Test with updated contract MyEscrow.sol: test

Tools Used

foundry tests

Recommendations

Do some checks to insure that user will be paid the correct amount.
Here is an example:
[starts on line 134]
[ends on 141]