[H-03] ABI encodePacked Collision

[codehawks-bot]

[H-03] ABI encodePacked Collision

Severity

High Risk

Relevant GitHub Links

https://github.com/Cyfrin/2023-07-escrow/blob/main/src/EscrowFactory.sol#L71

https://github.com/Cyfrin/2023-07-escrow/blob/main/src/EscrowFactory.sol#L76

Summary

Collision can exist due to the use of many dynamic types in abi.encodePacked

Vulnerability Details

The computeEscrowAddress() function in EscrowFactory.sol calls abi.encodePacked() with multiple dynamic arguments and a collision is possible.

Impact

High impact on the creation of contracts

Tools Used

• Slither

Recommendations

Do not use more than one dynamic type in abi.encodePacked(). Use abi.encode().

[pinalikefruit]

The same issue is reported in this case as valid. Cyfrin/2023-08-sparkn#1 (comment)

The difference is that it categorizes badly and should have reported it as low.

[PatrickAlphaC]

If their is a collision hash, the transaction reverts, or you just redeploy. No loss.