Summary

The current fee validation logic only checks if the arbiter fee is greater than or equal to the price of the transaction. This validation is insufficient.

Vulnerability Details

In the constructor of Escrow.sol contract, the i_arbiterFee is set to a specific amount. The check only ensures that the arbiter fee is not less than the price. However, this does not prevent setting an excessive fee that could potentially harm the interests of the parties involved. There should be a limit or threshold on the fee, such as 10-20% of the price.

Impact

inadequate fee validation could reduce the trust of users in the escrow system. Any malicious buyer can set the arbiter fee to a very small amount or even 0, which will provide less incentive to the arbiter to resolve disputes. So, there should be a min/max fee system.
Also, there should be a check if no arbiter is set, the fee should be set to 0.

Tools Used

Manual Analysis

Recommendations

Consider adding upper and lower limits for setting up fees.