Tokens utilizing a Blocklist, such as USDC, can hinder the Seller or Arbiter from accessing the funds
Summary
USDC token has implemented an administratively owned blocklist feature, effectively restricting users from transmitting or acquiring funds within this Token.
Vulnerability Details
The vulnerability may arise when the SELLER or ARBITER is unaware of being included in the USDC blocklist, before initiating an Escrow. The escrow contract does not currently incorporate the proper verifications to mitigate this specific blocklist scenario, leading to funds becoming stucked within the Escrow.
This vulnerability holds significant importance due to the widespread use of the USDC token and its intended application in Escrows. As such, careful attention must be given to addressing and mitigating this issue effectively.
Impact
Due to the lack of verification for the Seller's or Arbiter's presence on the blocklist, the Escrow might be unable to disburse funds to them.
Tools Used
Static review
Recommendations
To address this vulnerability, it is advisable to implement a check within the constructor of the Escrow contract, specifically verifying whether the Token used in the Escrow is USDC and consequently checking for blocklist.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.