Based on the functionality, if the `releaseEscrow()` function can be called by unauthorized entities, it can lead to potential misuse or unintended transfer of assets.
Audit: 2023-10-wildcat-findings
Severity: HIGH

# Lines of code

https://github.com/code-423n4/2023-10-wildcat/blob/main/src/WildcatSanctionsEscrow.sol#L25


# Vulnerability details

## Impact
The absence of access control on the `releaseEscrow()` function presents a significant security risk. As it currently stands, any external actor or contract can invoke this function, which may result in the unintended release of escrowed funds. This opens up potential attack vectors where malicious actors can drain the funds stored in the contract without meeting the intended conditions for fund release.

Given that escrows are typically used to hold significant amounts of assets in a trustless environment (pending certain conditions are met), the exploitation of this vulnerability can lead to substantial financial losses for the stakeholders involved. Additionally, it can undermine trust in the platform or system that utilizes this contract, deterring potential users and stakeholders from engaging with it in the future.

## Proof of Concept
Deployment of Vulnerable Contract:
Deploy the WildcatSanctionsEscrow contract on a test network.

Populate the Escrow:
Send a significant amount of assets to the contract address to simulate an escrowed amount.

Unauthorized Release:
Using an unrelated Ethereum address (one that is neither the borrower nor the account), invoke the releaseEscrow() function.

Verify Asset Transfer:
Check the balance of the account address. If the assets have been transferred without the intended conditions being met, the vulnerability is confirmed.

GitHub Link: [WildcatSanctionsEscrow.sol](https://github.com/code-423n4/2023-10-wildcat/blob/main/src/WildcatSanctionsEscrow.sol)

```solidity
 function canReleaseEscrow() public view override returns (bool) {
    return !WildcatSanctionsSentinel(sentinel).isSanctioned(borrower, account);
  }

  function escrowedAsset() public view override returns (address, uint256) {
    return (asset, balance());
  }

  function releaseEscrow() public override {
    if (!canReleaseEscrow()) revert CanNotReleaseEscrow();

    uint256 amount = balance();

    IERC20(asset).transfer(account, amount);

    emit EscrowReleased(account, asset, amount);
  }
```
## Tools Used
VS code
## Recommended Mitigation Steps

#### Implement Access Control:

Introduce a modifier in the WildcatSanctionsEscrow contract that restricts access to the releaseEscrow() function. This modifier should only allow specific addresses (e.g., the borrower or the account) to call the function.
```solidity
modifier onlyAuthorized() {
    require(msg.sender == borrower || msg.sender == account, "Not authorized");
    _;
}
```

#### Update the Vulnerable Function:

Apply the newly created onlyAuthorized modifier to the releaseEscrow() function:

```solidity
function releaseEscrow() public onlyAuthorized override {
    ...
}
```

#### Testing:

After making the changes, it's crucial to test the contract thoroughly. Ensure that only the allowed addresses can call releaseEscrow() and that unaut