Submission Details
Severity:
Incompatible with some deflationary token
Summary
Incompatible with some deflationary token
Vulnerability Details
Since the escrow contract is open to use, it may allow any token during the escrow process, in some extreme case that if the token take extra fee from the event, for example, if user send 100 tokens to others, it will actually send 100 + fee.
Impact
The escrow may DoS at the dispute stage
Tools Used
Manual
Recommendations
It need to adjust the validation based on the fee mode of the token:
uint256 tokenBalance = i_tokenContract.balanceOf(address(this));
uint256 totalFee = buyerAward + i_arbiterFee; // Reverts on overflow
if (totalFee > tokenBalance) {
revert Escrow__TotalFeeExceedsBalance(tokenBalance, totalFee);
}
Prize pool breakdown
Total prize
40,000 USDC
nSLOC
186215 USDC / LOC
37,000 USDC
3,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.