Skip to content

Latest commit

 

History

History
22 lines (12 loc) · 987 Bytes

L-04.md

File metadata and controls

22 lines (12 loc) · 987 Bytes
Raw

ERC20 with blacklisting feature could block assets

Summary

Any wallet blacklisted will block the distribute process. E.g. USDC and USDT use this feature.

Vulnerability Details

Even though the contract uses safeTransfer to send the tokens to the winner, this function will revert if the recipient is blacklisted. In this case that address can be removed from the winner list, an the issue will be solved. But, in a worst case scenario, if the STADIUM_ADDRESS is blacklisted, the whole distribution process will be blocked for ever.

Impact

Probability: Low. Is not likely that the STADIUM_ADDRESS is blacklisted. Severity: High. The distribution process would be blocked irreversibly.

Tools Used

Solodit.

Recommendations

Make STADIUM_ADDRESS a parameter of the distribution function, so it can be changed in case of emergency.