CodeHawks Escrow Contract - Competition Details

Summary : Fee on transfered token is not considered.

Vulnerability Details :

There are ERC20 tokens that charge fee for every transfer() / transferFrom(). In the current implementation, It assumes that the received amount is the same as the transfer amount.

Impact :

The amount of tokens tranfered to the contract and later distributed between seller or arbitrer (In case of dispute) might be less than expected.

Tools Used : manually done

Recommendations :

It is recommended to find the balance of the current contract before and after the transferFrom to see how much tokens were received, and approve only what was received.