CodeHawks Escrow Contract - Competition Details

Summary

After calling the initiateDispute() function either by the Buyer or the Seller if the Arbiter is malicious or anything happen to his wallet the funds will be stuck forever since there is not a max limit of time for the Arbiter to decide.

Vulnerability Details

https://github.com/Cyfrin/2023-07-escrow/blob/main/src/Escrow.sol#L109-L129

Since this function is onlyArbiter and the Buyer and Seller can't do anything after a dispute is initiated, the arbiter has no incentive at all to resolve the problem quicker and can take as much time as he wants or even leave the funds locked if he decides not to grab his fees.

Impact

Funds can be locked by the arbiter by not taking any action after the Escrow is in dispute.

Tools Used

Manual Review

Recommendations

Add a max duration of time the arbiter can decide and after that either change the arbiter or reimburse the buyer.