If Arbiter is a contract, ensure that it has code
Summary
If the arbiter account is a contract, it ought to be ensured at Escrow construction time that it has code.
Vulnerability Details
The arbiter can be an EOA or a contract. Currently, it is only checked if this address is non-zero or not. However, this is not enough; in case it is a contract, it must have a codesize of greater than 0.
Impact
Low
Tools Used
Manual Review
Recommendation
At Escrow construction time, perform a codesize check on arbiter address and ensure it is not zero. The codesize can be fetched via address.code, which returns a byte array of the bytecode residing at the address. Then, .length can be used on the resulting value to get the array length.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.