CodeHawks Escrow Contract - Competition Details

Summary

Potential Address Calculation Issue

Vulnerability Details

In the newEscrow function of the EscrowFactory contract, there is a missing check for a zero value generated by the computeEscrowAddress function. This could lead to unexpected behavior, although the likelihood of occurrence is low.

Impact

Failed Contract Deployments: If the computed address is zero, the deployment of the new Escrow contract will fail, leading to a loss of gas and potential disruptions in the intended flow of the contract.

Tools Used

Manually

Recommendations

To mitigate this potential issue, it is recommended to add a check for zero when computing the predictedAddress in the computeEscrowAddress function. Additionally, verify that the computed address falls within the valid address range (2^160-1) before proceeding with contract deployment or any critical operations involving the computed address.