CodeHawks Escrow Contract - Competition Details

Summary

When a dispute occurs either party can call initiateDispute() to have an agreed-upon arbiter decide between the two parties. If a token like USDC is used for payment and any of the parties happen to get on that list at any point after the Escrow is deployed then it can prevent the resolution of the dispute.

Vulnerability Details

1. Buyer initiates a contract using USDC as the payment method.

2. An issue occurs and either party calls dispute.

3. Arbiter is on USDC's block list

4. Arbiter attempts to call a function to resolve the dispute but the transaction reverts.

5. The funds remain stuck and inaccessible until the arbiter is removed from the block list.

Impact

A dispute cannot be resolved if any of the parties are on a block list.

Tools Used

manual

Recommendations

If transfer to a party fails skip him so funds aren’t stuck and save his portion into a mapping.