CodeHawks Escrow Contract - Competition Details

Summary

Some tokens take a transfer fee (e.g. STA, PAXG). According to my knowledge, the Escrow contract will use the WETH token. However in the past, some tokens like USDT and USDC did not charge a fee, but after a while, they started to take a fee on transfers.

Impact

• Potential Loss of Funds: In the worst-case scenario, tokens may become trapped in a contract if it is not equipped to handle the fee deduction. If the contract expects a certain amount and receives less, it may not function correctly, leading to a loss of funds.

• User Experience: From a user's perspective, these fees can create confusion and unexpected costs, particularly if they are not clearly disclosed or if the user is unaware that the token includes transfer fees.

Tools Used

Manual Review

Recommendations

Use the balance before and after the transfer to calculate the received amount instead of assuming that it would be equal to the amount passed as a parameter.