CodeHawks Escrow Contract - Competition Details

Summary

The newEscrow() function in the Factory contract can be invoked by any user to establish escrows for any seller or arbiter.

Vulnerability Detail

The unrestricted access to the newEscrow() function could potentially lead to spam escrows. The absence of an owner verification mechanism or fees allows users to create escrows for arbitrary addresses.

Impact

The unrestricted access to the newEscrow() function could lead to unnecessary network congestion and the creation of fraudulent escrow contracts.

Tools Used

A detailed review of the code base was conducted to identify this issue.

Recommendation

Consider incorporating owner validations on this function or charge a fee when external users create an escrow to deter spam. In this case, deducting a fee might be more appropriate measure.