`arbiterFee` can be set to zero .
Summary
No input validation while creating a new escrow give opportunities to a buyer to maliciously set arbiterFee to 0 . Also , it may get ignored completely while monitoring the protocol as EscrowCreated event doesnot emit arbiterFee data .
Vulnerability Details
A following exploit can happen :
1 . A Buyer creates an escrow setting the arbiterFee to 0 .
2 . A dispute happens .
3 . Arbiter solves the dispute but gets nothing as arbiterFee was set to zero .
Impact
Loss for the protocol
Tools Used
Manual review
Recommendations
Consider introducing a minimum arbiterfee and check if arbiterFee is fulfilling the condition .
And most importantly emit arbiterFee data in EscrowCreated event for better monitoring .
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.