CodeHawks Escrow Contract - Competition Details
Cyfrin
Foundry
40,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Tokens locked caused by incorrect arbiter address

ivanfitro

Summary

Tokens may be blocked forever if a wrong arbiter address is settled in the constructor.

Vulnerability Details

The root of the vulnerability lies in the assignment of the arbiter address during contract deployment. An incorrect address can lead to a scenario where the onlyArbiter modifier, present in the resolveDispute() function, prevents the tokens from being unlocked. Consequently, the tokens associated with these contract will be rendered inaccessible indefinitely.

modifier onlyArbiter() {
if (msg.sender != i_arbiter) {
revert Escrow__OnlyArbiter();
}
_;
}
function resolveDispute(uint256 buyerAward) external onlyArbiter
nonReentrant inState(State.Disputed) {...}

Impact

Tokens will be locked forever in the contract.

Tools Used

Manual review

Recommendations

To mitigate this vulnerability, you colud implement a two-step verification process, similar to the Ownable2Step mechanism. Before transitioning the State to Disputed upon calling initiateDispute(), the system should perform an additional verification step to ensure that the arbiter address is correct.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.