USDC token has implemented an administratively owned blocklist feature, effectively restricting users from transmitting or acquiring funds within this Token.
The vulnerability may arise when the SELLER or ARBITER is unaware of being included in the USDC blocklist, before initiating an Escrow. The escrow contract does not currently incorporate the proper verifications to mitigate this specific blocklist scenario, leading to funds becoming stucked within the Escrow.
This vulnerability holds significant importance due to the widespread use of the USDC token and its intended application in Escrows. As such, careful attention must be given to addressing and mitigating this issue effectively.
Due to the lack of verification for the Seller's or Arbiter's presence on the blocklist, the Escrow might be unable to disburse funds to them.
Static review
To address this vulnerability, it is advisable to implement a check within the constructor of the Escrow contract, specifically verifying whether the Token used in the Escrow is USDC and consequently checking for blocklist.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.