search

Cyfrin / 2023-07-escrow

17 stars 12 forks source link

Receipt can't be confirmed if seller is blacklisted by the asset #869

Open codehawks-bot opened 11 months ago

codehawks-bot commented 11 months ago

Receipt can't be confirmed if seller is blacklisted by the asset

Severity

Medium Risk

Summary

The function that confirms a receipt confirmReceipt attempts to transfer the award tokenContract to the seller. If the tokenContract implements a blacklist like the common USDC token, the transfer may be impossible and the confirmation will fail.

Vulnerability Details

The function which release tokenContract assets to the seller after sucessfully audit the protocol for buyer:

    function confirmReceipt() external onlyBuyer inState(State.Created) {
        s_state = State.Confirmed;
        emit Confirmed(i_seller);

        i_tokenContract.safeTransfer(i_seller, i_tokenContract.balanceOf(address(this)));
    }

The function will fail if seller is blacklisted by the token.

Impact

This can both impact the buyer and the seller if the Escrow contract was declared with non-arbiter address, fund would be stuck then if one party is blacklisted.

Tools Used

Manual

Recommendations

  1. Allow seller to specify another address by declaring a new function call changeSeller with modifier of onlySeller().