Submission Details
Severity:
Seller can receive more than the price when confirmReceipt().
Summary
Seller can receive more than the price when confirmReceipt().
Vulnerability Details
When buyer confirms receipt, escrow contract will send its balance to seller instead of the escrow's price. Some times, buyer can send more than the price to escrow before or after it's created, and then buyer will loss extra money (balanceof(this) - price) and seller will receive more than the price.
function confirmReceipt() external onlyBuyer inState(State.Created) {
s_state = State.Confirmed;
emit Confirmed(i_seller);
i_tokenContract.safeTransfer(i_seller, i_tokenContract.balanceOf(address(this)));
}
Impact
Buyer will loss and seller can get more money than the escrow's price.
Tools Used
Manual
Recommendations
Need to check the balance of escrow is greater than the escrow's price, if so, need to send the extra to buyer.
function confirmReceipt() external onlyBuyer inState(State.Created) {
s_state = State.Confirmed;
emit Confirmed(i_seller);
uint256 extra = i_tokenContract.balanceOf(address(this)) - price;
i_tokenContract.safeTransfer(i_seller, price);
if (extra > 0) {
i_tokenContract.safeTransfer(i_buyer, extra);
}
}
Prize pool breakdown
Total prize
40,000 USDC
nSLOC
186215 USDC / LOC
37,000 USDC
3,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.