If one winner is blacklisted no one can get rewards
Summary
Tokens like USDC and USDT have blacklists and will revert if transfers are made to blacklisted users.
Vulnerability Details
If an address of a winner is blacklisted from either USDC or USDT the highlighted code will revert and no winner will get rewards.
Impact
Low impact since it's not that likely for an address to be blacklisted. And the caller can call the function again without the address of the blacklisted winner or with another address provided by the blacklisted winner.
Tools Used
Manuel Review
Recommendations
Implement a function for winners to pull their funds from the protocol, rather than using a push method of distributing rewards. Or implement a check if an address of the winner is blacklisted if the token used is USDC or USDT
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.