CodeHawks Escrow Contract - Competition Details

Summary

the newescrow doesnt check if the token address which buyer sets is fake/wrong token.

Vulnerability Details

as you know we have a function called newEscrow in EscrowFactory.sol this function is used to create new escrews between seller and buyer the problem is the function doesn't check if the IERC20 tokenContract even exists or is a fake token.

Impact

there is 2 scenarios in here

• the first buyer can make a token address really close to the real official tokens address and get free service and give fake tokens

• the second scenario is when a user accidentally makes a mistake in input address and gives an incorrect address again close to the real one but incorrect accidentally in this way again user will lose funds

Tools Used

manually/vscode

Recommendations

• you can implement simple token whitelist list

• Add an explicit check before calling safeTransferFrom that the tokenContract is a contract and not an EOA.