CodeHawks Escrow Contract - Competition Details

Summary

The zero address check performed on the buyer address in Escrow constructor is redundant.

Vulnerability Details

The following check performed in Escrow constructor is redundant:

if (buyer == address(0)) revert Escrow__BuyerZeroAddress();

Reason being, the buyer is the msg.sender for EscrowFactory, and no call from address(0) can ever be made to EscrowFactory. As such, this check (and the accompanying test) is redundant and ought to be removed to save on gas. With this change,Escrow size and deployment cost will fall.

Impact

Gas

Recommendation

Remove the zero-address check for the buyer from Escrow constructor (along with Escrow__BuyerZeroAddress();, the error from IEscrow).

With this change in place, a total gas saving of 3717 gas was seen across all tests. The gas saved ranged from 122 to 280 for relevant tests. Escrow saw a reduction of 26 bytes in contract size from 3666 to 3640, whereas the deployment cost for Escrow fell by 25 gas.