CodeHawks Escrow Contract - Competition Details

Summary

Vulnerability Details

According to the fact that EIP-20 states that zero-valued transfers must be accepted.

Checking non-zero transfer values can avoid an expensive external call and save gas.
While this is done at some places, it’s not consistently done in the solution.

There are 2 instances of this issue:

• Adding a non-zero-value check for tokenContract.safeTransferFrom(msg.sender,computedAddress,price) at the beginning of EscrowFactory.newEscrow(uint256,IERC20,address,address,uint256,bytes32)

• Adding a non-zero-value check for i_tokenContract.safeTransfer(i_seller,i_tokenContract.balanceOf(address(this))) at the beginning of Escrow.confirmReceipt()

Impact

Tools Used

Recommendations

Consider adding a non-zero-value check at the beginning of function.