CodeHawks Escrow Contract - Competition Details

Summary

The contract currently doesn't enforce any restrictions or checks concerning the arbiter's address.

Vulnerability Detail

The absence of a specified arbiter's address could potentially lead to deadlock situations where a malevolent buyer intentionally abstains from invoking confirmReceipt(). Furthermore, if the arbiter's address is identical to that of the seller or buyer, it could facilitate illicit activities such as funds theft or non-payment for services.

Impact

This could potentially result in a deadlock in the contract and facilitate fraudulent activities.

Tools Used

1. A detailed review of the code base was conducted to identify this issue.

2. Foundry testing.

Recommendation

It would be beneficial to enforce the arbiter's address to differ from those of the seller, buyer, and address(0x). Additionally, a trusted arbiter's address should be made known to both parties, allowing for a correctness check when the contract is created.