CodeHawks Escrow Contract - Competition Details

Summary

Arbiter fees might be too low for the arbiter to resolve dispute.

Vulnerability Details

Arbiter fees is set at constructor by the buyer of the escrow contract. There is a upper limit to which arbiter fees can be set i.e if (arbiterFee >= price) revert Escrow__FeeExceedsPrice(price, arbiterFee); but there is no lower limit. Hence, because of extremely low arbiter fees, Arbiter can choose not to resolve dispute at all which is a serious issue

Impact

If arbiter chooses not to resolve dispute between the buyer and the seller, the amount will be stuck forever in the contract as arbiter is the only one who can transfer funds in the state of dispute between buyer and seller.

Tools Used

Manual Analysis

Recommendations

Arbiter fees can be set as per the percentage of the total amount in the contract.