CodeHawks Escrow Contract - Competition Details

Summary

There is a possibility for the buyer to maliciously call the initiate dispute function which would reduce what is payable to the seller as a portion of the sellers fee would be payed to the arbiter anytime a dispute is initiated.

Vulnerability Details

The buyer can call the initiate dispute function in a bid to reduce what is payable to the seller since the arbiter would have to take his cut from the pool of money payable to the seller. So whenever a dispute is initiated the seller would lose part of his money.

Impact

The seller would lose a potion of his money anytime the dispute is initiated regardless of there being an error or not so a malicious buyer can call it just to reduce the sellers reward

Tools Used

github

Recommendations

There should be a separate money payable as the arbitration fee which can be refunded if no dispute is initiated