CodeHawks Escrow Contract - Competition Details

Summary

Functions that are not meant to be called by anyone other than buyer, seller or arbiter (so all state modifying functions), can be made payable to save on gas. This makes calls cheaper for legitimate/ expected callers.

Vulnerability Details

The functions confirmDeposit, initiateDispute and resolveDispute will revert if anyone otherthan the parties or the arbiter cals them. As such, making them payable can net gas savings for the legitimiate callers i.e., the buyer, seller and arbiter.

Making these functions payable, a gas saving of ~3200 was made on each test, with a total of 74158 gas saved across all the tests. On the other hand, the deployment cost was reduced by 3200 to 588700 gas, and deployment size fell by 16 bytes to 3650.

Impact

Gas

Tools Used

Forge, Foundry Toolkit (gas report, gas snapshots)

Recommendation

Make confirmDeposit(), initiateDispute() and resolveDispute() payable.