CodeHawks Escrow Contract - Competition Details

Summary

With Fee on transfer tokens, whenever someone tries to create an Escrow, there is an error. The user is unaware and loses gas money.

Vulnerability Details

In the newEscrow function of EscrowFactory.sol, tokens are transferred to Escrow with tokenContract.safeTransferFrom(msg.sender, computedAddress, price); Here, the escrow side has this validation: if (tokenContract.balanceOf(address(this)) < price) revert Escrow__MustDeployWithTokenBalance();
With fee on transfer tokens, it is always tokenContract.balanceOf(address(this)) < price, which results in an error.

Impact

Users lose gas money.

Tools Used

Manual

Recommendations

Add permission to create Escrow only from newEscrow and remove validation on price.