CodeHawks Escrow Contract - Competition Details
Cyfrin
Foundry
40,000 USDC
View results
Previous Next
Submission Details
Severity: gas
Valid

using a malicious/strange ERC20 token to steal funds from another Escrow contract.

0xbugalba

Summary

Using a malicious/strange ERC20 token in the Escrow contract could effectively cause problems.

Some possible attack vectors are:

A token that accidentally reverts in transfer or transferFrom could prevent funds from being transferred correctly.
A token with arbitrary logic in transferFrom could lead to unexpected state changes.
A token that mints new tokens in transfer could manipulate balances.

function newEscrow(
uint256 price,
IERC20 tokenContract, //@this can be a weird tokencontract
address seller,
address arbiter,
uint256 arbiterFee,
bytes32 salt

Vulnerability Details

POC

function test_change() public {
vm.startPrank(BUYER);
​
ERC20Mock(address(i_tokenContract)).mint(BUYER, PRICE);
ERC20Mock(address(i_tokenContract)).approve(address(escrowFactory), PRICE);
​
escrow = escrowFactory.newEscrow(PRICE, i_tokenContract, SELLER, ARBITER, ARBITER_FEE, SALT1);
escrow.getTokenContract();
​
vm.stopPrank();
​
//escrow => 0xBDbbA0C45E0AEd4aA03A4Ff629C8EE750cBf3437
//escrow2 => 0x8b5D2A146eED65EF59A3BD909c91A500afcb6283
​
vm.startPrank(alice);
​
ERC20Mock(address(Ohack_usd)).mint(alice, PRICE);
ERC20Mock(address(Ohack_usd)).approve(address(escrowFactory), PRICE);
uint256 balanceHackusdBefore= ERC20Mock(address(Ohack_usd)).balanceOf(0x667e2b4406371e78029953Fa820Be795C7AFdeb7);
console.log("balanceHackusdBefore",balanceHackusdBefore);
assertEq(0,balanceHackusdBefore);
​
escrow = escrowFactory.newEscrow(PRICE, Ohack_usd, SELLER, ARBITER, ARBITER_FEE, SALT1);
escrow.getTokenContract();
​
​
ERC20Mock(address(i_tokenContract)).totalSupply();
ERC20Mock(address(Ohack_usd)).totalSupply();
​
​
ERC20Mock(address(i_tokenContract)).balanceOf(0xBDbbA0C45E0AEd4aA03A4Ff629C8EE750cBf3437);
uint256 balanceHackusd= ERC20Mock(address(Ohack_usd)).balanceOf(0x8b5D2A146eED65EF59A3BD909c91A500afcb6283);
​
console.log("balanceHackusdBefore",balanceHackusd);
assertEq(PRICE,balanceHackusd);
​
vm.stopPrank();
}

Impact

Tools Used

Recommendations

Some ways to mitigate this risk are:

Maintaining a whitelist of permitted tokens in EscrowFactory.
Validating that the token adheres to the ERC20 standard correctly.
Introducing emergency pauses in case a malicious token is detected.
Limiting access to critical functions like transfer/transferFrom.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.