CodeHawks Escrow Contract - Competition Details

Summary

Funds could be frozen

Vulnerability Detail

need to check if the arbiter address is not 0. if the arbiter address is 0 then resolveDispute or initiateDispute
function will be inaccessible, because of onlyArbiter modifier.

1. buyer creates Escrow contract with 0 address arbiter (human make mistakes), and transfer tokens to it.

2. now the buyer Dispute with seller.

3. buyer tries to execute initiateDispute function.

4. it will fail because address == 0 now the funds are frozen in the contract.

Impact

funds are lost because there is not way to restore buyer's funds.

Code Snippet

Tool used

Manual Review

Recommendation

add arbiter 0 address check in constructor.