Sparkn

CodeFox Inc.
DeFiFoundryProxy
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

If USDC address is blacklisted `_distribute` will not work

tsvetanovv

Summary

The protocol currently uses whitelisted tokens which the admin adds. Some tokens (e.g. USDC, USDT) have a contract level admin controlled address blacklist. If an address is blocked, then transfers to and from that address are forbidden.

Vulnerability Details

In Distributor.sol we have _distribute() function:

function _distribute(address token, address[] memory winners, uint256[] memory percentages, bytes memory data)
internal
{
// token address input check
if (token == address(0)) revert Distributor__NoZeroAddress();
if (!_isWhiteListed(token)) {
revert Distributor__InvalidTokenAddress();
}
// winners and percentages input check
if (winners.length == 0 || winners.length != percentages.length) revert Distributor__MismatchedArrays();
uint256 percentagesLength = percentages.length;
uint256 totalPercentage;
for (uint256 i; i < percentagesLength;) {
totalPercentage += percentages[i];
unchecked {
++i;
}
}
// check if totalPercentage is correct
if (totalPercentage != (10000 - COMMISSION_FEE)) {
revert Distributor__MismatchedPercentages();
}
IERC20 erc20 = IERC20(token);
uint256 totalAmount = erc20.balanceOf(address(this));
​
// if there is no token to distribute, then revert
if (totalAmount == 0) revert Distributor__NoTokenToDistribute();
​
uint256 winnersLength = winners.length; // cache length
for (uint256 i; i < winnersLength;) {
uint256 amount = totalAmount * percentages[i] / BASIS_POINTS;
erc20.safeTransfer(winners[i], amount);
unchecked {
++i;
}
}
​
// send commission fee as well as all the remaining tokens to STADIUM_ADDRESS to avoid dust remaining
_commissionTransfer(erc20);
emit Distributed(token, winners, percentages, data);
}

This is the main function from which prizes are sent to winners. But imagine the situation if the erc20 token (for example USDC) is blacklisted. Then sending a transfer is impossible.

147: erc20.safeTransfer(winners[i], amount);

Impact

It is impossible for the winners to get their prizes

Tools Used

Visual Studio Code

Recommendations

Try to implement a try-catch solution where you skip certain funds whenever they cause the USDC transfer to revert or use pull over push model to transfer tokens.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.