CodeHawks Escrow Contract - Competition Details

Summary

i_price should be used over i_tokenContract.balanceOf(address(this)

Vulnerability Details

When the escrow contract is created, the seller should only receive i_price tokens (if there was no arbiter involved).
But in the confirmReceipt() method, the seller is sent i_tokenContract.balanceOf(address(this)) tokens, which could be more or less than i_price.

Impact

The seller can be paid less/more if the contract's token balance is different thatn i_price

Tools Used

Manual Code Review

Recommendations

i_price should be used over i_tokenContract.balanceOf(address(this) when paying the amount to the seller