CodeHawks Escrow Contract - Competition Details

Summary

Buyer is able to reset the escrow contract. Deploy multiple Escrow.sol contracts to the same address.

Vulnerability Details

It is possible to deploy a second/multiple contracts at the same address as a result of using the “computeEscrowAddress” function. For example, the escrow is in the disputed state the buyer can change their nonce and deploy another escrow contract at the same address by calling “computeEscrowAddress” again as a result the escrow will never be resolved. The escrowed tokens/money will be stuck in the Escrow.sol contract.

Impact

Funds will never reach the seller.

Tools Used

Solidity docs, hardhat

Recommendations

Add another parameter to the contract "computeEscrowAddress" that cannot be repeated. Maybe a call to a chainlink VRF or a counter for the EscrowFactory.sol that is added to the inputs of the "computeEscrowAddress" function to prevent Escrow.sol being deployed to the same address.