40,000 USDC
View results
Submission Details
Severity: medium

`i_price` should be used over `i_tokenContract.balanceOf(address(this)`

Summary

i_price should be used over i_tokenContract.balanceOf(address(this)

Vulnerability Details

When the escrow contract is created, the seller should only receive i_price tokens (if there was no arbiter involved).
But in the confirmReceipt() method, the seller is sent i_tokenContract.balanceOf(address(this)) tokens, which could be more or less than i_price.

Impact

The seller can be paid less/more if the contract's token balance is different thatn i_price

Tools Used

Manual Code Review

Recommendations

i_price should be used over i_tokenContract.balanceOf(address(this) when paying the amount to the seller

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.