CodeHawks Escrow Contract - Competition Details

M1: An address can be arbiter and seller by mistake.

Summary

If the seller and arbiter are set to the same address by mistake from the buyer when the method "newEscrow" from EscrowFactory is called, designed seller can initiate a dispute and resolve this dispute to retrieve all the funds from the contract.

Vulnerability Details

1. The buyer calls new escrow from Escrow Factory with

2. The seller/arbiter calls initiate dispute.

3. The seller/arbiter calls resolvedispute with a buyer award set to 0.

Impact

Loss of funds given to the Escrow Contract

Tools Used

None

Recommendations

Add this line to the constructor (l.184) from Escrow.sol:
if (seller == arbiter) revert Escrow__SellerArbiterSameAddress();