CodeHawks Escrow Contract - Competition Details
Cyfrin
Foundry
40,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Lack of input validation in newEscrow function

0xCiphky

Summary

The newEscrow function lacks input validation checks

  • The arbiter address should be validated to ensure it is not the same as the buyer or seller address. The arbiter is expected to be an impartial, trusted actor who can resolve disputes between the buyer and seller. If the arbiter is also the buyer or seller, this impartiality is compromised.

Vulnerability Details

If the arbiter is also the buyer or seller, it could lead to disputes being resolved unfairly. This is contrary to the intended role of the arbiter as an impartial third party.

Impact

The lack of these input validations could lead to disputes being unfairly resolved

Tools Used

Manual analysis

Recommendations

To mitigate these issues, consider adding the following validation checks in the newEscrow function:

function newEscrow(
uint256 price,
IERC20 tokenContract,
address seller,
address arbiter,
uint256 arbiterFee,
bytes32 salt
) external returns (IEscrow) {
require(arbiter != buyer && arbiter != seller, "Arbiter must be different from buyer and seller");
// rest of the function code
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.