CodeHawks Escrow Contract - Competition Details
Cyfrin
Foundry
40,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`i_arbiter` CAN GET BLACKLISTED BY THE TOKEN CONTRACT THUS LOCKING THE BUYER FUNDS IN THE `Escrow` CONTRACT

Udsen

Impact

The i_arbiter address could get blacklisted by the tokenContract thus completely locking teh buyer funds in the Escrow contract since disputes can be resolved now. Hence the Escrow.confirmReceipt can not be called by the buyer to release the funds to the seller. The Escrow.resolveDispute can not be fully executed by the i_arbiter address since the token transfer will revert since i_arbiter is blacklisted in the tokenContract.

Vulnerability Details

if (i_arbiterFee > 0) {
i_tokenContract.safeTransfer(i_arbiter, i_arbiterFee);
}

https://github.com/Cyfrin/2023-07-escrow/blob/main/src/Escrow.sol#L122-L124

Tools Used

Manual Review and VSCode

Recommendations

Hence it is recommended to choose an ERC20 token as payment token, which does not have the blacklist functionality.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.