Summary

Any residual funds after all the transactions get stuck in the contract

Vulnerability Details

After the payment is done using confirmReceipt, the residual funds should be transferred to the buyer.
Otherwise, if the escrow contract was funded multiple times, or something wrong happened which could have led to the initialization of the contract with more balance than needed, then that fun never leaves the contract and the buyer may never be able to recover the funds.

Impact

Residual balances can get stuck in the Escrow contract

Tools Used

Manual Code Review

Recommendations

The code can be changed to send the residual funds back to the buyer.