Submission Details
Severity:
A user who is in a token's blacklist will DoS the whole distribution
Summary
A single user can DoS the whole distribution.
Vulnerability Details
Some tokens, such as USDT and USDC, have blacklist mechanisms allowing for admins blocking all transfers towards and from a certain wallet. In the case where one of the winners is within a token's blacklist, the whole transaction will revert and no user will receive any funds.
uint256 winnersLength = winners.length; // cache length
for (uint256 i; i < winnersLength;) {
uint256 amount = totalAmount * percentages[i] / BASIS_POINTS;
erc20.safeTransfer(winners[i], amount);
unchecked {
++i;
}
}
Impact
Distribution will be DoS
Tools Used
Manual review
Recommendations
implement pull-over-push mechanism
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
19477 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.