CodeHawks Escrow Contract - Competition Details

Summary

The amount of tokens that will be distributed to seller or to the parties in case of dispute is not i_price but i_tokenContract.balanceOf(address(this)).

If getPrice returns the token that will be distributed, it should return the real amount that is indeed used by confirmReceipt and resolveDispute

Vulnerability Details

While it's true that the contract has been initialized with a specific i_price value, it's not true that it will be the real amount distributed to the seller or the actors during the dispute distributions.

The contract could receive external funds at any point in time by transferring some i_tokenContract directly to it.

If getPrice should return the amount of tokens that will be later distributed, it should return i_tokenContract.balanceOf(address(this)) instead of i_price.

Impact

Better UX and DX

Tools Used

Manual

Recommendations

The client should consider returning i_tokenContract.balanceOf(address(this)) in getPrice() function