CodeHawks Escrow Contract - Competition Details

Summary

Some tokens take a transfer fee (e.g. STA, PAXG), some do not currently charge a fee but may do so in the future (e.g. USDT, USDC).

Vulnerability Details

In the constructor of Escrow.sol, there is a check if tokenContract.balanceOf(address(this)) < price. If the buyer uses Fee-on-Transfer token as tokenContract, the creation of the Escrow contract will be always reverted as the actual balance is less than the price which the buyer provides (fee deducted on the amount of transfer).

Impact

1. This cause some inconvenience to the buyer, assume he/she doesn't know that the token is a Fee-on-Transfer one. Which confusing the buyer and waste the buyer's gas money.

Tools Used

Manual

Recommendations

1. Make a blocklist of tokens which don't behave normal in any circumstances so that the creation of Escrow is smooth.