Polluting buyer's and agent's available funds

[zajck]

#322 addresses the possibility to fill up the seller's available funds with unwanted tokens since anyone can deposit funds on the seller's behalf.

It's possible to do the same to buyers and agents as well.

To fill up the buyer's available funds, a malicious actor can act as a seller and:

1. create an offer with an unwanted token and non-zero seller deposit;
2. commit on the buyer's behalf
3. revoke voucher, which releases unwanted token (seller deposit) to the buyer

To fill up the agent's available funds, a malicious actor can act as a seller and:

1. create an offer with an unwanted token and assign the agent to the offer;
2. commit to the offer;
3. redeem the voucher;
4. finalize the exchange, which releases the unwanted token (percentage of the price) to the agent

• This fills up their available funds but does not send the (potentially malicious) token directly to the recipient. But the recipient can still withdraw it.
• This does not affect the withdrawal of other buyer's or agent's funds
• This pollutes getAvailableFunds with unwanted tokens
• Dispute resolvers are not affected, since they can receive DR fees only in the exchange tokens they specify.