Submission Details
Severity:
"arbiter == seller" is not checked, funds may be stolen.
Summary
In the constructor of Escrow.sol, seller and arbiter are neighboring arguments, which can lead to erroneous input. If the buyer mistakenly sets seller==arbiter, the seller will steal the funds by initiateDispute and resolveDispute.
Vulnerability Details
As above, the constructor does a zero address check, but does not check if the same arguments are set
Impact
Buyer loses funds
Tools Used
Manual
Recommendations
revert if arbiter == seller
Prize pool breakdown
Total prize
40,000 USDC
nSLOC
186215 USDC / LOC
37,000 USDC
3,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.