CodeHawks Escrow Contract - Competition Details

Summary

Wrong incentive design favors the buyer

Vulnerability Details

The buyer is responsible for setting a correct arbiterFee, however not setting that correctly punishes the seller.

Assume this scenario:

• Arbiter fee for CodeHawks is 1000 USDC

• buyer sets an escrow with arbiterFee = 1 USDC

• seller completes the audit and shares it

• buyer does not release the funds

• since the arbiterFee is not set correctly, CodeHawks is not incentivized to resolve the dispute.

• seller, although did not do anything wrong, may lose the funds

• resolving the conflict may cause the arbiter to actually lose funds on GAS

Impact

Incentive Design

Tools Used

Manual Review

Recommendations

• There can be a mechanism for the arbiter to accept the contract. Before the arbiter accepts, parties should not start working on the audit.

• Or, there should be warnings in the UI that shows escrows with wrong arbiterFee