CodeHawks Escrow Contract - Competition Details
Cyfrin
Foundry
40,000 USDC
View results
Previous Next
Submission Details
Severity: low

Misplaced address zero check on arbiter address

funkornaut

Summary

The address(0) check on the arbiter address should be moved into the constructor of the Escrow contract.

Vulnerability Details

For the Escrow contract to have a chance at working as expected the arbiter address cannot be the 0 address. If it happens to get accidentally set to 0 on creation the only way for funds to be released is by the buyer calling confirmReceipt(). The contract performs this check but only in the initiateDispute() function. It should be moved into the constructor.

Impact

Funds will be stuck in the contract if the buyer never calls confirmReceipt().

Tools Used

Manual Review

Recommendations

Add an address zero check on the arbiter in the constructor.

constructor(
uint256 price,
IERC20 tokenContract,
address buyer,
address seller,
address arbiter,
uint256 arbiterFee
) {
if (address(tokenContract) == address(0)) revert Escrow__TokenZeroAddress();
if (buyer == address(0)) revert Escrow__BuyerZeroAddress();
if (seller == address(0)) revert Escrow__SellerZeroAddress();
if (arbiter == address(0)) revert Escrow__DisputeRequiresArbiter();

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.