CodeHawks Escrow Contract - Competition Details

Summary

Multiple calls of token balance wastes gas

Vulnerability Details

Calling the token balance function multiple times in the code is not advised as it wastes gas used for external calls. This could also be more severe if a transfer to the buyer or arbiter fails without the checks, all the remaining token balance will be sent to the seller, making the buyer/arbiter lose funds completely and irreversibly.

Impact

External calls should be as minimum as possible to avoid gas wastage and calculations should be done for remaining value instead of external calls

Tools Used

Remix, VsCode

Recommendations

Instead of calling the balance again, subtract the totalFee from the initial tokenBalance as the remainingBalance and replace the second tokenBalance with the new remainingBalance.