Summary

Creating an Escrow contract through a factory with an arbiter with same address as buyer can result in advantage to buyer, the arbiter should be impartial as write in README.

Vulnerability Details

It is possible to create an Escrow contract using the function EscrowFactory.newEscrow(). Almost all variables are validated in the constructor, except for one: the arbiter address. If the buyer set the value for the arbiter address to himself, after the seller complete the work he can call initiateDispute() and then resolveDispute() paying less to seller.

Impact

The Escrow contract can be creating using any address to arbiter, the buyer can set it to himself and take advantage of seller by calling initiateDispute() and then paying less or nothing to seller for his work.

Tools Used

Manual Review

Recommendations

It is recommended to validate the arbiter in the Escrow contract constructor to be different from buyer