CodeHawks Escrow Contract - Competition Details

Summary

[L] If the arbiter is not set, arbiter fee should not be positive

Vulnerability Details

In the constructor of Escrow.sol, unlike other params like buyer, seller and tokenContract; arbiter is not required to be nonzero. The reason for this is the possibility to create an escrow without an arbiter.
However if this is the case, there is no check that ensure if the arbiterFee equals to zero which allows a weird state where there is no arbiter but there is a positive arbiterFee.

Impact

Since without an arbiter it is not possible to initiateDispute(), the issue does not cause any problems exept from a faulty state where there is a positive arbiterFee without an arbiter

Tools Used

Manual Review

Recommendations

If the arbiter equals to address(0), require arbiterFee to be equal to 0.