CodeHawks Escrow Contract - Competition Details

Summary

lack of a check for the existence of the escrow before initiating a dispute.

Vulnerability Details

Currently, there is no check implemented to verify the existence of the escrow before initiating a dispute. This means that anyone can call the initiateDispute function on any address, regardless of whether it represents a valid escrow or not.

Impact

Unauthorized disputes: Without the existence check, anyone can initiate a dispute on any address, even if it does not represent a valid escrow. This can lead to unauthorized disputes and unnecessary conflicts between parties.

Tools Used

Manual Analysis

Recommendations

Add a check in the initiateDispute function to verify the existence of the escrow before allowing the dispute to be initiated. This can be done by checking the state of the escrow or maintaining a mapping of valid escrow addresses.