Summary

USDC token has implemented an administratively owned blocklist feature, effectively restricting users from transmitting or acquiring funds within this Token.

Vulnerability Details

The vulnerability may arise when the SELLER or ARBITER is unaware of being included in the USDC blocklist, before initiating an Escrow. The escrow contract does not currently incorporate the proper verifications to mitigate this specific blocklist scenario, leading to funds becoming stucked within the Escrow.

This vulnerability holds significant importance due to the widespread use of the USDC token and its intended application in Escrows. As such, careful attention must be given to addressing and mitigating this issue effectively.

Impact

Due to the lack of verification for the Seller's or Arbiter's presence on the blocklist, the Escrow might be unable to disburse funds to them.

Tools Used

Static review

Recommendations

To address this vulnerability, it is advisable to implement a check within the constructor of the Escrow contract, specifically verifying whether the Token used in the Escrow is USDC and consequently checking for blocklist.