CodeHawks Escrow Contract - Competition Details

Summary

Reentrancy vulnerability in the newEscrow function.

Vulnerability Details

The newEscrow function is vulnerable to reentrancy attacks. This is because the function calls the safeTransferFrom function, which can be interrupted by another contract. If an attacker interrupts the safeTransferFrom function, they can call another function before the safeTransferFrom function has completed. This would allow the attacker to steal the funds that were supposed to be transferred to the escrow contract.

Impact

The reentrancy vulnerability in the newEscrow function could allow an attacker to steal funds from the escrow contract

Tools Used

Slither, VsCode, Remix

Recommendations

To fix the reentrancy vulnerability, the newEscrow function should be updated to use a mutex to prevent other contracts from calling any function while the safeTransferFrom function is executing.