Summary

When a buyer initiates a dispute, the arbiter fee is taxed from the audit price. This could be harmful to the seller as they would get a lower award.

Vulnerability Details

In particular, in the scenario that a buyer starts a dispute and the arbiter decides that the seller should get all of the awards, the seller's payment would be negatively impacted even though they did not initiate the dispute, nor was their audit unsatisfactory.

Impact

Consequently, if the arbiter fee is 1,000$ and the entire price is 10,000$ the seller would receive only 9,000$, even though their audit was good enough for the arbiter to resolve the dispute completely in the seller's favor.

Tools Used

Manual review

Recommendations

The arbiterFee and price constructor parameters should not be related to each other. The fee amount should be transferred by the buyer to the Escrow contract balance, in addition to the audit price(if the audit price is 10,000$ and fee is 1,000 should be transferred by the buyer). After that if there is no dispute the fee should be transferred back to the buyer.