CodeHawks Escrow Contract - Competition Details

Summary - Vulnerability Details

This is a design issue and I think protocol should not punish the seller when he/she is not guilty.

If the buyer is not confirming the receipt then the seller has only 1 solution left to initiate a dispute. Let's suppose the seller is 100% right and he provided the work as required, and the arbitrator also confirms that the seller has provided the required work.

Now, if the arbiter transfers the funds to the seller then the arbiter fee will be deducted from his total amount which is not fair for him/her when he/she performed his work.

Impact

Sellers will lose some percentage without any reason! and worst case if the seller agrees on a higher percentage at the start on buyers insist.

Tools Used

Manual Review

Recommendations

There should be a second function for only the arbiter to call, where he can transfer all amounts to the seller in those scenarios.